theory Ipc_C

lemma lookupExtraCaps_ccorres:
  notes if_cong[cong] nat_min_simps [simp del]
  shows
  "ccorres
     ((\<lambda>ft _ err.
                   cfault_rel (Some ft) (errfault err) (errlookup_fault err))
          \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))
      (liftxf errstate fst snd
           (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))))
      (valid_pspace' and tcb_at' thread
             and (case buffer of Some x\<Rightarrow> valid_ipc_buffer_ptr' x | _ \<Rightarrow> \<top>)
             and (\<lambda>s. unat (msgExtraCaps info) <= 3))
      (UNIV \<inter> {s. thread_' s = tcb_ptr_to_ctcb_ptr thread}
            \<inter> {s. bufferPtr_' s = option_to_ptr buffer}
            \<inter> {s. seL4_MessageInfo_lift (info_' s) = mi_from_H info
                  }) []
      (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc)" proof - let ?curr = "\<lambda>s. current_extra_caps_' (globals s)" let ?EXCNONE = "{s. ret__unsigned_long_' s = scast EXCEPTION_NONE}" let ?interpret = "\<lambda>v n. take n (array_to_list (excaprefs_C v))" note empty_fail_cond[simp] show ?thesis apply (rule ccorres_gen_asm)+ apply (cinit(no_subst_asm) lift: thread_' bufferPtr_' info_' simp: whileAnno_def) apply (clarsimp simp add: getExtraCPtrs_def lookupCapAndSlot_def
                               capFault_bindE
                     simp del: Collect_const) apply (simp add: liftE_bindE del: Collect_const) apply wpc apply (rename_tac word1 word2 word3 word4) apply (simp del: Collect_const) apply wpc apply (simp add: option_to_ptr_def option_to_0_def) apply (rule ccorres_rhs_assoc2, rule ccorres_split_throws) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (simp add: excaps_map_def) apply (subst interpret_excaps_test_null[where n=0, simplified, symmetric]) apply (simp add: word_sle_def word_sless_def) apply vcg apply (simp add: id_def[symmetric] del: Collect_const) apply (rule ccorres_symb_exec_r) apply (simp add: option_to_ptr_def option_to_0_def Collect_False
                        ccorres_cond_iffs
                   del: Collect_const) apply csymbr apply (rename_tac "lngth") apply (unfold mapME_def)[1] apply (simp add: mi_from_H_def del: Collect_const) apply (rule ccorres_symb_exec_l) apply (rule_tac P="length xs = unat word2" in ccorres_gen_asm) apply csymbr apply (rule ccorres_rhs_assoc2) apply (rule ccorres_add_returnOk2,
                 rule ccorres_splitE_novcg) apply (rule_tac xf'="?curr"
                        and  r'="\<lambda>xs v. excaps_map xs = ?interpret v (length xs)"
                        and   Q="UNIV"
                        and   F="\<lambda>n s. valid_pspace' s \<and> tcb_at' thread s \<and>
                                       (case buffer of Some x \<Rightarrow> valid_ipc_buffer_ptr' x | _ \<Rightarrow> \<top>) s \<and>
                                        (\<forall>m < length xs. user_word_at (xs ! m)
                                                      (x2 + (of_nat m + (msgMaxLength + 2)) * 4) s)"
                           in ccorres_sequenceE_while') apply (simp add: split_def) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_guard_imp2) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=cptr_' in ccorres_abstract, ceqv) apply (ctac add: capFaultOnFailure_ccorres
                                [OF lookupSlotForThread_ccorres']) apply (rule_tac P="is_aligned rv 4" in ccorres_gen_asm) apply (simp add: ccorres_cond_iffs liftE_bindE) apply (rule ccorres_symb_exec_l [OF _ _ _ empty_fail_getSlotCap]) apply (rule_tac P'="UNIV \<inter> {s. excaps_map ys
                                                          = ?interpret (?curr s) (length ys)}
                                                    \<inter> {s. i_' s = of_nat (length ys)}"
                                      in ccorres_from_vcg[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (simp add: returnOk_liftE) apply (clarsimp simp: Bex_def in_monad) apply (clarsimp simp: excaps_map_def array_to_list_def
                                                 lookupSlot_raw_rel_def) apply (subgoal_tac "length ys < 3") apply (simp add: take_Suc_conv_app_nth take_map
                                             unat_of_nat32[unfolded word_bits_conv]
                                             word_of_nat_less) apply (simp add: word_less_nat_alt) apply wp+ apply (clarsimp simp: ccorres_cond_iffs) apply (rule_tac  P= \<top>
                                 and P'="{x. errstate x= lu_ret___struct_lookupSlot_raw_ret_C \<and>
                                             rv' = (xs ! length ys)}"
                                   in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def) apply (frule lookup_failure_rel_fault_lift, assumption) apply (clarsimp simp: cfault_rel2_def) apply (clarsimp simp: cfault_rel_def) apply (simp add: seL4_Fault_CapFault_lift) apply (clarsimp simp: is_cap_fault_def) apply wp apply (rule hoare_post_imp_R, rule lsft_real_cte) apply (clarsimp simp: obj_at'_def projectKOs objBits_simps') apply (vcg exspec=lookupSlot_modifies) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: valid_pspace'_def) apply (drule spec, drule(1) mp) apply (drule(1) user_word_at_cross_over [OF _ _ refl]) apply (simp add: field_simps msgMaxLength_def
                                    seL4_MsgLengthBits_def
                                    seL4_MsgMaxLength_def
                                    msgLengthBits_def) apply (subst valid_ipc_buffer_ptr_array, simp+,
                          simp add: msg_align_bits unat_word_ariths unat_of_nat,
                          simp add: msg_align_bits unat_word_ariths unat_of_nat)+ apply clarsimp apply simp apply (rule conseqPre) apply (vcg exspec=lookupSlot_modifies) apply clarsimp apply (simp add: split_def) apply (rule hoare_pre, wp) apply simp apply (simp add: word_less_nat_alt word_bits_def) apply simp apply (rule ceqv_tuple2) apply ceqv apply ceqv apply (simp del: Collect_const) apply (rule_tac P'="{s. snd rv'=?curr s}"
                        and P="\<lambda>s. length rv = length xs \<and> (\<forall>x \<in> set rv. snd x \<noteq> 0)"
                        in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def
                                  seL4_MsgExtraCapBits_def) apply (simp add: word_sle_def interpret_excaps_def
                             excaps_map_def) apply (rule conjI) apply (clarsimp simp: array_to_list_def) apply (rule takeWhile_eq, simp_all)[1] apply (drule_tac f="\<lambda>xs. xs ! m" in arg_cong) apply (clarsimp simp: split_def NULL_ptr_val[symmetric]) apply (clarsimp simp: array_to_list_def) apply (rule takeWhile_eq, simp_all)[1] apply (drule_tac f="\<lambda>xs. xs ! m" in arg_cong) apply (clarsimp simp: split_def NULL_ptr_val[symmetric]) apply (simp add: min.absorb1 word_less_nat_alt) apply simp apply (simp add: mapME_def[symmetric] split_def
                            liftE_bindE[symmetric]) apply (wp mapME_length mapME_set | simp)+ apply (rule_tac Q'="\<lambda>rv. no_0_obj' and real_cte_at' rv"
                        in hoare_post_imp_R, wp lsft_real_cte) apply (clarsimp simp: cte_wp_at_ctes_of) apply (wpsimp)+ apply (clarsimp simp: guard_is_UNIV_def
                         elim!: inl_inrE) apply (rule hoare_pre, (wp mapM_wp' | simp)+) apply (rule mapM_loadWordUser_user_words_at) apply simp apply vcg apply (rule conseqPre, vcg, clarsimp) apply clarsimp apply (rule conjI) apply (clarsimp simp add: valid_pspace'_def) apply (simp add: upto_enum_step_def
               split: if_split_asm) apply (simp add: word_size upto_enum_word field_simps wordSize_def'
                 del: upt.simps) apply (clarsimp simp: excaps_map_def option_to_ptr_def option_to_0_def
                          valid_ipc_buffer_ptr'_def) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (state)
goal (1 subgoal):
 1. ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (state)
goal (1 subgoal):
 1. ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (state)
goal (1 subgoal):
 1. ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (state)
goal (1 subgoal):
 1. ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (state)
this:
empty_fail ?f \<Longrightarrow> empty_fail (K_bind ?f ?x)
empty_fail (?f ?x) \<Longrightarrow> empty_fail (?f $ ?x)
\<lbrakk>?P \<Longrightarrow> empty_fail ?f; \<not> ?P \<Longrightarrow> empty_fail ?g\<rbrakk> \<Longrightarrow> empty_fail (if ?P then ?f else ?g)
\<lbrakk>?P \<Longrightarrow> empty_fail (?f ?x); \<not> ?P \<Longrightarrow> empty_fail (?g ?x)\<rbrakk> \<Longrightarrow> empty_fail ((if ?P then ?f else ?g) ?x)
?S \<noteq> {} \<Longrightarrow> empty_fail (select ?S)
(fst ?S = {} \<Longrightarrow> snd ?S) \<Longrightarrow> empty_fail (select_f ?S)
\<lbrakk>empty_fail ?a; \<And>x. empty_fail (?b x)\<rbrakk> \<Longrightarrow> empty_fail (?a >>= ?b)
(\<And>x. empty_fail (?f x)) \<Longrightarrow> empty_fail (Nondet_Monad.lift ?f ?x)
empty_fail ?f \<Longrightarrow> empty_fail (liftE ?f)
\<lbrakk>empty_fail ?f; \<And>rv. empty_fail (?g rv)\<rbrakk> \<Longrightarrow> empty_fail (?f >>=E ?g)
(\<And>x. x \<in> set ?xs \<Longrightarrow> empty_fail (?m x)) \<Longrightarrow> empty_fail (mapM ?m ?xs)
(?P \<Longrightarrow> empty_fail ?f) \<Longrightarrow> empty_fail (whenE ?P ?f)
(\<not> ?P \<Longrightarrow> empty_fail ?f) \<Longrightarrow> empty_fail (unlessE ?P ?f)
\<lbrakk>empty_fail ?f; \<And>x. empty_fail (?g x)\<rbrakk> \<Longrightarrow> empty_fail (?f <catch> ?g)
(?P \<Longrightarrow> empty_fail ?x) \<Longrightarrow> empty_fail (when ?P ?x)
(\<not> ?P \<Longrightarrow> empty_fail ?f) \<Longrightarrow> empty_fail (unless ?P ?f)
empty_fail ?m \<Longrightarrow> empty_fail (liftM ?f ?m)
empty_fail ?m \<Longrightarrow> empty_fail (liftME ?f ?m)
\<lbrakk>empty_fail ?L; \<And>r. empty_fail (?R r)\<rbrakk> \<Longrightarrow> empty_fail (?L <handle> ?R)
\<lbrakk>empty_fail ?f; \<And>e. empty_fail (?handler e)\<rbrakk> \<Longrightarrow> empty_fail (?f <handle2> ?handler)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (Nondet_Monad.sequence ?ms)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (sequence_x ?ms)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (sequenceE ?ms)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (sequenceE_x ?ms)
(\<And>m. m \<in> ?f ` set ?ms \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (mapM_x ?f ?ms)
(\<And>m. m \<in> ?f ` set ?xs \<Longrightarrow> empty_fail m) \<Longrightarrow> empty_fail (mapME ?f ?xs)
(\<And>m'. m' \<in> ?f ` set ?xs \<Longrightarrow> empty_fail m') \<Longrightarrow> empty_fail (mapME_x ?f ?xs)
(\<And>m. m \<in> set ?ms \<Longrightarrow> empty_fail (?P m)) \<Longrightarrow> empty_fail (filterM ?P ?ms)
(\<And>x y. empty_fail (?f x y)) \<Longrightarrow> empty_fail (zipWithM_x ?f ?xs ?ys)
(\<And>x y. empty_fail (?f x y)) \<Longrightarrow> empty_fail (zipWithM ?f ?xs ?ys)
\<forall>x. empty_fail (?f x) \<Longrightarrow> empty_fail (maybeM ?f ?t)
\<lbrakk>empty_fail ?P; empty_fail ?a; empty_fail ?b\<rbrakk> \<Longrightarrow> empty_fail (ifM ?P ?a ?b)
\<lbrakk>empty_fail ?P; empty_fail ?a; empty_fail ?b\<rbrakk> \<Longrightarrow> empty_fail (ifME ?P ?a ?b)
\<lbrakk>empty_fail ?P; empty_fail ?f\<rbrakk> \<Longrightarrow> empty_fail (whenM ?P ?f)
\<lbrakk>empty_fail ?A; empty_fail ?B\<rbrakk> \<Longrightarrow> empty_fail (andM ?A ?B)
\<lbrakk>empty_fail ?A; empty_fail ?B\<rbrakk> \<Longrightarrow> empty_fail (orM ?A ?B)
empty_fail ?A \<Longrightarrow> empty_fail (notM ?A)
(\<And>r. empty_fail (?B r)) \<Longrightarrow> empty_fail (whileLoop ?C
  ?B ?r)
(\<And>r. empty_fail (?B r)) \<Longrightarrow> empty_fail (whileLoopE ?C
  ?B ?r)
\<lbrakk>empty_fail ?C; empty_fail ?B\<rbrakk> \<Longrightarrow> empty_fail (whileM ?C ?B)

goal (1 subgoal):
 1. ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (prove)
goal (1 subgoal):
 1. unat (msgExtraCaps info) \<le> 3 \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>infoa bufferPtr threada. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q1616 infoa bufferPtr threada) (?Q'1616 infoa bufferPtr threada) [SKIP] (liftE (getExtraCPtrs buffer info) >>=E mapME (\<lambda>cptr. capFaultOnFailure cptr False (lookupCapAndSlot thread cptr))) (IF bufferPtr = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(bufferPtr,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(threada,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(UCAST(32 \<rightarrow> 32) \<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1616 infoa bufferPtr threada s \<and> s' \<in> ?Q'1616 infoa bufferPtr threada proof (prove)
goal (2 subgoals):
 1. \<And>infoa. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q1616 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread)) (?Q'1616 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (liftE (case info of Types_H.message_info.MI x count xa xb \<Rightarrow> do intSize <- return (fromIntegral wordSize);
case buffer of None \<Rightarrow> return [] | Some bufferPtr \<Rightarrow> do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. bufferPtr + PPtr ((x + offset) * intSize)) [1 , 2 .e. count]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od
od) >>=E mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
rva <- liftE (getSlotCap rv);
capFaultOnFailure cptr False (returnOk (rva, rv))
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1616 infoa bufferPtr threada s \<and> s' \<in> ?Q'1616 infoa bufferPtr threada proof (prove)
goal (2 subgoals):
 1. \<And>infoa. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q1616 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread)) (?Q'1616 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] ((case info of Types_H.message_info.MI x count xa xb \<Rightarrow> do intSize <- return (fromIntegral wordSize);
case buffer of None \<Rightarrow> return [] | Some bufferPtr \<Rightarrow> do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. bufferPtr + PPtr ((x + offset) * intSize)) [1 , 2 .e. count]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od
od) >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1616 infoa bufferPtr threada s \<and> s' \<in> ?Q'1616 infoa bufferPtr threada proof (prove)
goal (2 subgoals):
 1. \<And>infoa x1 x2 x3 x4. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; info = Types_H.message_info.MI x1 x2 x3 x4\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1638 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) a x1 x2 x3 x4) (?R''1639 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) x1 x2 x3 x4) [SKIP] (do intSize <- return (fromIntegral wordSize);
case buffer of None \<Rightarrow> return [] | Some bufferPtr \<Rightarrow> do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. bufferPtr + PPtr ((x + offset) * intSize)) [1 , 2 .e. x2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> ?R1638 infoa bufferPtr threada s x xa xb xc) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> ?R''1639 infoa bufferPtr threada x xa xb xc}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; info = Types_H.message_info.MI word1 word2 word3 word4\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1638 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) a word1 word2 word3 word4) (?R''1639 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) [SKIP] (do intSize <- return (fromIntegral wordSize);
case buffer of None \<Rightarrow> return [] | Some bufferPtr \<Rightarrow> do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. bufferPtr + PPtr ((x + offset) * intSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> ?R1638 infoa bufferPtr threada s x xa xb xc) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> ?R''1639 infoa bufferPtr threada x xa xb xc}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1638 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) a word1 word2 word3 word4) (?R''1639 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) [SKIP] ((case buffer of None \<Rightarrow> return [] | Some bufferPtr \<Rightarrow> do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. bufferPtr + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od) >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> ?R1638 infoa bufferPtr threada s x xa xb xc) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> ?R''1639 infoa bufferPtr threada x xa xb xc}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1659 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) (?R''1661 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) [SKIP] (return [] >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 3. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> ?R1659 infoa bufferPtr threada x xa xb xc s) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> ?R''1661 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1659 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) (?R''1661 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) [SKIP] (returnOk []) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(NULL);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 3. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> ?R1659 infoa bufferPtr threada x xa xb xc s) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> ?R''1661 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1659 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) (?P'1677 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) [SKIP] (returnOk []) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa))
 2. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1676 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},UNIV
 3. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> ?R1659 infoa bufferPtr threada x xa xb xc s) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> ?P'1677 infoa bufferPtr threada x xa xb xc \<inter> ?R'1676 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) rv (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))) s)}
 2. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1676 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},UNIV
 3. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> ?R'1676 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 \<sigma>. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk [] \<sigma>). (\<sigma>', globals_update (current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (current_extra_caps_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) rv (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))) (globals_update (current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (current_extra_caps_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1676 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},UNIV
 3. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> ?R'1676 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> interpret_excaps (excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (current_extra_caps_' (globals x))) = excaps_map []
 2. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1676 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},UNIV
 3. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> ?R'1676 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> interpret_excaps (excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (current_extra_caps_' (globals x))) = []
 2. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1676 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},UNIV
 3. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> ?R'1676 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> excaprefs_C (excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (current_extra_caps_' (globals x))).[0] = NULL
 2. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1676 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},UNIV
 3. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> ?R'1676 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>infoa word1 word2 word3 word4. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1676 infoa NULL (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4) \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa) {},UNIV
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 3. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> ?R'1676 infoa bufferPtr threada x xa xb xc} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr buffer) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (do offset <- return (msgMaxLength + 1);
return (map (\<lambda>x. x2 + PPtr ((x + offset) * word_of_nat wordSize)) [1 , 2 .e. word2]) >>= mapM (liftM CPtr \<circ> loadWordUser)
od >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr buffer = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr buffer);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>a. ?R1658 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 a x2) (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) [SKIP] (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr (Some x2));;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1658 infoa bufferPtr threada x xa xb xc s xd)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) (?Q'1736 infoa word1 word2 word3 word4 x2) [SKIP] (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(option_to_ptr (Some x2));;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI (?Q'1736 infoa word1 word2 word3 word4 x2)
 3. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) (?Q'1736 infoa word1 word2 word3 word4 x2) [SKIP] (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_extraCaps_'proc(infoa);;
(\<acute>length___unsigned_long :== \<acute>ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI (?Q'1736 infoa word1 word2 word3 word4 x2)
 3. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 ret__unsigned. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ret__unsigned = extraCaps_CL (seL4_MessageInfo_lift infoa)\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) (?G'1747 infoa word1 word2 word3 word4 x2 ret__unsigned) [SKIP] (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (\<acute>length___unsigned_long :== ret__unsigned;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1747 infoa word1 word2 word3 word4 x2 v}
 3. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = extraCaps_CL (seL4_MessageInfo_lift infoa)\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) (?G'1747 infoa word1 word2 word3 word4 x2 lngth) [SKIP] (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) >>= mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE)) (\<acute>length___unsigned_long :== lngth;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1747 infoa word1 word2 word3 word4 x2 v}
 3. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = extraCaps_CL (seL4_MessageInfo_lift infoa)\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) (?G'1747 infoa word1 word2 word3 word4 x2 lngth) [SKIP] (do xs <- mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]);
sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)
od) (\<acute>length___unsigned_long :== lngth;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1747 infoa word1 word2 word3 word4 x2 v}
 3. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) (?G'1747 infoa word1 word2 word3 word4 x2 word2) [SKIP] (do xs <- mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]);
sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)
od) (\<acute>length___unsigned_long :== word2;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1747 infoa word1 word2 word3 word4 x2 v}
 3. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2013 infoa word1 word2 word2 word3 word4 x2 xs) (?Q'2011 infoa word1 word2 word2 word3 word4 x2 xs) [SKIP] (sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)) (\<acute>length___unsigned_long :== word2;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>?Q2013 infoa word1 word2 word2 word3 word4 x2\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 5. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q2013 infoa word1 word2 v word3 word4 x2 rv s \<longrightarrow> s' \<in> ?Q'2011 infoa word1 word2 v word3 word4 x2 rv}}
 6. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?G2022 infoa word1 word2 word2 word3 word4 x2 xs) (?Q'2011 infoa word1 word2 word2 word3 word4 x2 xs) [SKIP] (sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)) (\<acute>length___unsigned_long :== word2;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < \<acute>length___unsigned_long\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. ?G2022 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 5. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?G2022 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> ?Q'2011 infoa word1 word2 v word3 word4 x2 rv}}
 6. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?G2022 infoa word1 word2 word2 word3 word4 x2 xs) (?G'2032 infoa word1 word2 word2 word3 word4 x2 xs) [SKIP] (sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < word2\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. ?G2022 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 5. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?G2022 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> ?G'2032 infoa word1 word2 v word3 word4 x2 rv}}}
 6. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?G2022 infoa word1 word2 word2 word3 word4 x2 xs) (?G'2032 infoa word1 word2 word2 word3 word4 x2 xs) [SKIP] (sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < word2\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1);;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. ?G2022 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 5. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?G2022 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> ?G'2032 infoa word1 word2 v word3 word4 x2 rv}}}
 6. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (11 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'2271 infoa word1 word2 word3 word4 x2 lngth xs)) (?xf'2271 infoa word1 word2 word3 word4 x2 lngth xs) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?P2278 infoa word1 word2 word2 word3 word4 x2 xs) (?P'2272 infoa word1 word2 word2 word3 word4 x2 xs) [SKIP] (sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < word2\<rbrace> (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps);;
\<acute>i :== \<acute>i + 1))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2271 infoa word1 word2 word3 word4 x2 lngth xs) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; ?r'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv'\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (?r'2271 infoa word1 word2 word3 word4 x2 lngth xs)) (?xf'2271 infoa word1 word2 word3 word4 x2 lngth xs) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. ?P2278 infoa word1 word2 word2 word3 word4 x2 a and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 8. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 9. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P2278 infoa word1 word2 v word3 word4 x2 rv and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> ?P'2272 infoa word1 word2 v word3 word4 x2 rv \<inter> UNIV}}}
 10. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)) (UNIV \<inter> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>) [SKIP] (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! length ys) (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s)) \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> [SKIP] (doE rv <- capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys));
do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od
odE) (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s)) \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> [SKIP] (doE rv <- capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys));
do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od
odE) (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2);;
(\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
(IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys) (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) [SKIP] (doE rv <- capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys));
do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od
odE) (\<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2);;
(\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
(IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys) (?Q'2293 infoa word1 word2 word3 word4 x2 lngth xs ys) [SKIP] (doE rv <- capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys));
do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od
odE) (\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
(IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) (?Q'2293 infoa word1 word2 word3 word4 x2 lngth xs ys)
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; ?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys) (?G'2297 infoa word1 word2 word3 word4 x2 lngth xs ys rv') [SKIP] (doE rv <- capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys));
do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od
odE) (\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv');;
(IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> ?G'2297 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; ?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2290 infoa word1 word2 word3 word4 x2 lngth xs ys s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
A total of 19 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv) (?Q'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od) (IF lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>?Q2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv (lu_ret___struct_lookupSlot_raw_ret_C_' s))) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?G2536 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv) (?Q'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od) (IF lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2536 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv (lu_ret___struct_lookupSlot_raw_ret_C_' s))) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?G2536 infoa word1 word2 word3 word4 x2 word2 xs ys rv' rv) (?Q'2417 infoa word1 word2 word3 word4 x2 word2 xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (do rva <- getSlotCap rv;
capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2536 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> ?Q'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv (lu_ret___struct_lookupSlot_raw_ret_C_' s))) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
A total of 22 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C rva. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2564 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C rva) (?Q'2562 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C rva) [SKIP] (capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv))) (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>?Q2564 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q2564 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv (lu_ret___struct_lookupSlot_raw_ret_C_' s) rva sa \<longrightarrow> s' \<in> ?Q'2562 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv (lu_ret___struct_lookupSlot_raw_ret_C_' s) rva})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C rva. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) {s. \<exists>(rv, \<sigma>')\<in>fst (capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv'))) rv (current_extra_caps_' (globals s))}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C rva \<sigma>. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. i_' s < 3 \<and> (\<exists>(rv, \<sigma>')\<in>fst (capFaultOnFailure (xs ! length ys) False (returnOk (rva, rv)) \<sigma>). (\<sigma>', globals_update (current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>v. Arrays.update v (unat (i_' s)) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) (current_extra_caps_' (globals s)))) s) \<in> rf_sr \<and> inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv'))) rv (excaprefs_C_update (\<lambda>v. Arrays.update v (unat (i_' s)) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) (current_extra_caps_' (globals s))))}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv lu_ret___struct_lookupSlot_raw_ret_C rva \<sigma>. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> {s. excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s)))) \<and> i_' s = word_of_nat (length ys) \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. i_' s < 3 \<and> (\<exists>(rv, \<sigma>')\<in>fst (liftE (return (rva, rv)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (Suc (length ys)) (array_to_list (excaprefs_C rv'))) rv (excaprefs_C_update (\<lambda>v. Arrays.update v (unat (i_' s)) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)) (current_extra_caps_' (globals s))))}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv lu_ret___struct_lookupSlot_raw_ret_C rva \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4; excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); i_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> word_of_nat (length ys) < 3 \<and> excaps_map (ys @ [(rva, rv)]) = take (Suc (length ys)) (array_to_list (Arrays.update (excaprefs_C (current_extra_caps_' (globals x))) (unat (word_of_nat (length ys))) (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv lu_ret___struct_lookupSlot_raw_ret_C \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C = cte_Ptr rv; lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4; map (\<lambda>(cp, y). cte_Ptr y) ys = take (length ys) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); i_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> word_of_nat (length ys) < 3 \<and> take (length ys) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]) @ [cte_Ptr rv] = take (Suc (length ys)) (map (index (Arrays.update (excaprefs_C (current_extra_caps_' (globals x))) (unat (word_of_nat (length ys))) (cte_Ptr rv))) [0..<3])
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
A total of 24 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv lu_ret___struct_lookupSlot_raw_ret_C \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C = cte_Ptr rv; lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4; map (\<lambda>(cp, y). cte_Ptr y) ys = take (length ys) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); i_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr; length ys < 3\<rbrakk> \<Longrightarrow> word_of_nat (length ys) < 3 \<and> take (length ys) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]) @ [cte_Ptr rv] = take (Suc (length ys)) (map (index (Arrays.update (excaprefs_C (current_extra_caps_' (globals x))) (unat (word_of_nat (length ys))) (cte_Ptr rv))) [0..<3])
 2. \<And>infoa word1 word2 word3 word4 x2 xs ys rv lu_ret___struct_lookupSlot_raw_ret_C \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C = cte_Ptr rv; lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4; map (\<lambda>(cp, y). cte_Ptr y) ys = take (length ys) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); i_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> length ys < 3
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv lu_ret___struct_lookupSlot_raw_ret_C \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C = cte_Ptr rv; lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4; map (\<lambda>(cp, y). cte_Ptr y) ys = take (length ys) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); i_' x = word_of_nat (length ys); (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> length ys < 3
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap rv \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C lu_ret___struct_lookupSlot_raw_ret_C); lookupSlot_raw_ret_C.status_C lu_ret___struct_lookupSlot_raw_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; is_aligned rv 4\<rbrakk> \<Longrightarrow> \<lbrace>?G2561 infoa word1 word2 word2 word3 word4 x2 xs ys rv' rv\<rbrace> getSlotCap rv \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. ?G2561 infoa word1 word2 lngth word3 word4 x2 xs ys rv' rv and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
A total of 23 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err) (?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError err) (IF lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a)
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv' rv'a lu_ret___struct_lookupSlot_raw_ret_C w. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv rv'. excaps_map (ys @ [rv]) = take (length (ys @ [rv])) (array_to_list (excaprefs_C rv')))) (\<lambda>s. current_extra_caps_' (globals s)) (inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs))) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?QE2417 infoa word1 word2 word3 word4 x2 word2 xs ys rv' (Fault_H.fault.CapFault (xs ! length ys) False w)) (?Q''2417 infoa word1 word2 word3 word4 x2 word2 xs ys rv' (Fault_H.fault.CapFault (xs ! length ys) False w) rv'a lu_ret___struct_lookupSlot_raw_ret_C) [SKIP] (throwError (Fault_H.fault.CapFault (xs ! length ys) False w)) (\<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a);;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>?QE2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv'\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv' err (lu_ret___struct_lookupSlot_raw_ret_C_' s) (errstate s)))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv' rv'a lu_ret___struct_lookupSlot_raw_ret_C w. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> {x. errstate x = lu_ret___struct_lookupSlot_raw_ret_C \<and> rv' = xs ! length ys} \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(rv',SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C rv'a);;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C rv'a)) \<acute>current_extra_caps) {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.fault.CapFault (xs ! length ys) False w) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) rv (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))) s)}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv' rv'a lu_ret___struct_lookupSlot_raw_ret_C w \<sigma>. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) lu_ret___struct_lookupSlot_raw_ret_C\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {x. errstate x = lu_ret___struct_lookupSlot_raw_ret_C \<and> rv' = xs ! length ys} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = rv' && mask 32, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false && mask 1\<rparr> \<and> seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError (Fault_H.fault.CapFault (xs ! length ys) False w) \<sigma>). (\<sigma>', globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) s\<lparr>ret__unsigned_long_' := lookupSlot_raw_ret_C.status_C rv'a, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) rv (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))) (globals_update (current_fault_'_update (\<lambda>_. ret__struct_seL4_Fault_C_' t)) s\<lparr>ret__unsigned_long_' := lookupSlot_raw_ret_C.status_C rv'a, global_exn_var_' := Return\<rparr>)))}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv'a w \<sigma> x t. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = xs ! length ys, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (xs ! length ys) False w)) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (current_lookup_fault_' (globals x)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv'a w \<sigma> x t. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel w (lookupSlot_raw_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = xs ! length ys, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; \<exists>v. lookup_fault_lift (current_lookup_fault_' (globals x)) = Some v \<and> lookup_fault_to_H v = w\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (xs ! length ys) False w)) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (lookup_fault_lift (current_lookup_fault_' (globals x)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv'a \<sigma> x t v. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel (lookup_fault_to_H v) (lookupSlot_raw_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = xs ! length ys, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; lookup_fault_lift (current_lookup_fault_' (globals x)) = Some v\<rbrakk> \<Longrightarrow> cfault_rel (Some (Fault_H.fault.CapFault (xs ! length ys) False (lookup_fault_to_H v))) (seL4_Fault_lift (ret__struct_seL4_Fault_C_' t)) (Some v)
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv'a \<sigma> x t v. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel (lookup_fault_to_H v) (lookupSlot_raw_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = xs ! length ys, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_get_tag (ret__struct_seL4_Fault_C_' t) = SCAST(32 signed \<rightarrow> 32) seL4_Fault_CapFault; lookup_fault_lift (current_lookup_fault_' (globals x)) = Some v\<rbrakk> \<Longrightarrow> \<exists>cf'. seL4_Fault_lift (ret__struct_seL4_Fault_C_' t) = Some cf' \<and> (if is_cap_fault cf' then fault_to_H cf' v = Some (Fault_H.fault.CapFault (xs ! length ys) False (lookup_fault_to_H v)) else fault_to_H cf' undefined = Some (Fault_H.fault.CapFault (xs ! length ys) False (lookup_fault_to_H v)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys rv'a \<sigma> x t v. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; lookupSlot_raw_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookup_failure_rel (lookup_fault_to_H v) (lookupSlot_raw_ret_C.status_C rv'a) (errstate x); (\<sigma>, x) \<in> rf_sr; seL4_Fault_CapFault_lift (ret__struct_seL4_Fault_C_' t) = \<lparr>seL4_Fault_CapFault_CL.address_CL = xs ! length ys, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>; seL4_Fault_lift (ret__struct_seL4_Fault_C_' t) = Some (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = xs ! length ys, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>); lookup_fault_lift (current_lookup_fault_' (globals x)) = Some v\<rbrakk> \<Longrightarrow> if is_cap_fault (SeL4_Fault_CapFault \<lparr>seL4_Fault_CapFault_CL.address_CL = xs ! length ys, inReceivePhase_CL = SCAST(32 signed \<rightarrow> 32) false\<rparr>) then True else lookup_fault_to_H undefined = lookup_fault_to_H v
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> capFaultOnFailure (xs ! length ys) False (lookupSlotForThread thread (xs ! length ys)) \<lbrace>\<lambda>rv. (\<lambda>a. True) and (\<lambda>_. is_aligned rv 4)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and ?R2419 infoa word1 word2 word3 word4 x2 lngth xs ys) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?P'2674 infoa word1 word2 word3 word4 x2 lngth xs ys\<rbrace> lookupSlotForThread thread (xs ! length ys) \<lbrace>\<lambda>rv s. is_aligned rv 4\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> ?P'2674 infoa word1 word2 word3 word4 x2 lngth xs ys s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> ?P'2674 infoa word1 word2 word3 word4 x2 lngth xs ys s)) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv' rv s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; real_cte_at' rv s\<rbrakk> \<Longrightarrow> is_aligned rv 4
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys rv') \<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,rv') {s. (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> True \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>})) \<and> (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s)) (errstate s)) \<longrightarrow> s \<in> {x. errstate x = errstate s \<and> rv' = xs ! length ys}))}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'2417 infoa word1 word2 word3 word4 x2 lngth xs ys (cptr_' s)}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s. s \<in> {sa. capptr_'_update (\<lambda>_. cptr_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa) \<in> \<lbrace>\<acute>capptr = xs ! length ys\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t. (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (ret__struct_lookupSlot_raw_ret_C_' t)) \<longrightarrow> (\<forall>s. (s, sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>) \<in> rf_sr \<longrightarrow> excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals sa)))) \<and> i_' sa = word_of_nat (length ys)))) \<and> (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (sa\<lparr>globals := globals sa\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>))) \<longrightarrow> cptr_' s = xs ! length ys))}}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s \<and> s' \<in> ?Q'2290 infoa word1 word2 word3 word4 x2 lngth xs ys
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) False (hrs_htd (t_hrs_' (globals s))) \<and> s \<Turnstile>\<^sub>c (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) \<and> - 2147483648 \<le> sint seL4_MsgMaxLength + sint 2 \<and> sint seL4_MsgMaxLength + sint 2 \<le> 2147483647 \<and> ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) True (hrs_htd (t_hrs_' (globals s))) \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys \<and> (\<forall>t. (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (ret__struct_lookupSlot_raw_ret_C_' t)) \<longrightarrow> (\<forall>sa. (sa, s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>) \<in> rf_sr \<longrightarrow> excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s)))) \<and> i_' s = word_of_nat (length ys)))) \<and> (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys)))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2) {s'. (s, s') \<in> rf_sr}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s \<and> s' \<in> {s. ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) False (hrs_htd (t_hrs_' (globals s))) \<and> s \<Turnstile>\<^sub>c (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) \<and> - 2147483648 \<le> sint seL4_MsgMaxLength + sint 2 \<and> sint seL4_MsgMaxLength + sint 2 \<le> 2147483647 \<and> ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) True (hrs_htd (t_hrs_' (globals s))) \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys \<and> (\<forall>t. (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (ret__struct_lookupSlot_raw_ret_C_' t)) \<longrightarrow> (\<forall>sa. (sa, s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>) \<in> rf_sr \<longrightarrow> excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s)))) \<and> i_' s = word_of_nat (length ys)))) \<and> (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys)))}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s\<rbrakk> \<Longrightarrow> {s. ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) False (hrs_htd (t_hrs_' (globals s))) \<and> s \<Turnstile>\<^sub>c (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) \<and> - 2147483648 \<le> sint seL4_MsgMaxLength + sint 2 \<and> sint seL4_MsgMaxLength + sint 2 \<le> 2147483647 \<and> ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) True (hrs_htd (t_hrs_' (globals s))) \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys \<and> (\<forall>t. (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (ret__struct_lookupSlot_raw_ret_C_' t)) \<longrightarrow> (\<forall>sa. (sa, s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>) \<in> rf_sr \<longrightarrow> excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s)))) \<and> i_' s = word_of_nat (length ys)))) \<and> (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys)))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' sa)) False (hrs_htd (t_hrs_' (globals sa))) \<and> sa \<Turnstile>\<^sub>c (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' sa)) \<and> - 2147483648 \<le> sint seL4_MsgMaxLength + sint 2 \<and> sint seL4_MsgMaxLength + sint 2 \<le> 2147483647 \<and> ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' sa)) True (hrs_htd (t_hrs_' (globals sa))) \<and> (s, cptr_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' sa))) sa) \<in> rf_sr}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s \<and> s' \<in> {s. ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) False (hrs_htd (t_hrs_' (globals s))) \<and> s \<Turnstile>\<^sub>c (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) \<and> - 2147483648 \<le> sint seL4_MsgMaxLength + sint 2 \<and> sint seL4_MsgMaxLength + sint 2 \<le> 2147483647 \<and> ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) True (hrs_htd (t_hrs_' (globals s))) \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys \<and> (\<forall>t. (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (ret__struct_lookupSlot_raw_ret_C_' t)) \<longrightarrow> (\<forall>sa. (sa, s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>) \<in> rf_sr \<longrightarrow> excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s)))) \<and> i_' s = word_of_nat (length ys)))) \<and> (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys)))}
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s); s' \<in> \<lbrace>\<acute>i = word_of_nat (length ys) \<and> excaps_map ys = take (length ys) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace>\<rbrakk> \<Longrightarrow> (valid_pspace' and tcb_at' thread and (\<lambda>s. True \<and> True \<and> valid_objs' s)) s \<and> s' \<in> {s. ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) False (hrs_htd (t_hrs_' (globals s))) \<and> s \<Turnstile>\<^sub>c (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) \<and> - 2147483648 \<le> sint seL4_MsgMaxLength + sint 2 \<and> sint seL4_MsgMaxLength + sint 2 \<le> 2147483647 \<and> ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) True (hrs_htd (t_hrs_' (globals s))) \<and> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys \<and> (\<forall>t. (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. lookupSlot_raw_rel rv (lookupSlot_raw_ret_C.slot_C (ret__struct_lookupSlot_raw_ret_C_' t)) \<longrightarrow> (\<forall>sa. (sa, s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>) \<in> rf_sr \<longrightarrow> excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s)))) \<and> i_' s = word_of_nat (length ys)))) \<and> (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>w. err = Fault_H.fault.CapFault (xs ! length ys) False w \<and> lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)), globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>, lu_ret___struct_lookupSlot_raw_ret_C_' := ret__struct_lookupSlot_raw_ret_C_' t\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s))) (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' s)) = xs ! length ys)))}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length ys); excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s')))); pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; tcb_at' thread s; valid_ipc_buffer_ptr' x2 s; \<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys) = 0 \<or> array_assertion (PTR(32 word) x2) (unat (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys))) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4)) \<and> 0 \<le> 2147483650 + sint seL4_MsgMaxLength \<and> sint seL4_MsgMaxLength \<le> 2147483645 \<and> (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys) = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys)))) (hrs_htd (t_hrs_' (globals s')))) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))) = xs ! length ys \<and> (\<forall>t. lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s'\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))), globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))) = xs ! length ys)
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length ys); excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s')))); pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; tcb_at' thread s; valid_ipc_buffer_ptr' x2 s; user_word_at (xs ! length ys) (x2 + (word_of_nat (length ys) * 4 + (msgMaxLength * 4 + 8))) s\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys) = 0 \<or> array_assertion (PTR(32 word) x2) (unat (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys))) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4)) \<and> 0 \<le> 2147483650 + sint seL4_MsgMaxLength \<and> sint seL4_MsgMaxLength \<le> 2147483645 \<and> (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys) = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys)))) (hrs_htd (t_hrs_' (globals s')))) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))) = xs ! length ys \<and> (\<forall>t. lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s'\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))), globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))) = xs ! length ys)
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length ys); excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s')))); pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; tcb_at' thread s; valid_ipc_buffer_ptr' x2 s; c_guard (PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + (msgMaxLength * 4 + 8)))) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + (msgMaxLength * 4 + 8))) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + (msgMaxLength * 4 + 8)))) = xs ! length ys\<rbrakk> \<Longrightarrow> (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys) = 0 \<or> array_assertion (PTR(32 word) x2) (unat (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys))) (hrs_htd (t_hrs_' (globals s')))) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4)) \<and> 0 \<le> 2147483650 + sint seL4_MsgMaxLength \<and> sint seL4_MsgMaxLength \<le> 2147483645 \<and> (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys) = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + word_of_nat (length ys)))) (hrs_htd (t_hrs_' (globals s')))) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))) = xs ! length ys \<and> (\<forall>t. lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>w. lookup_failure_rel w (lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t)) (errstate (s'\<lparr>cptr_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))), globals := globals s'\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals t), ghost'state_' := ghost'state_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) * 4 + word_of_nat (length ys) * 4))) = xs ! length ys)
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length ys); excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s')))); pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; tcb_at' thread s; valid_ipc_buffer_ptr' x2 s; c_guard (PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + 0x1E8))) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + 0x1E8)) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + 0x1E8))) = xs ! length ys\<rbrakk> \<Longrightarrow> (word_of_nat (length ys) + 0x7A = 0 \<or> array_assertion (PTR(32 word) x2) (unat (word_of_nat (length ys) + 0x7A)) (hrs_htd (t_hrs_' (globals s')))) \<and> (word_of_nat (length ys) + 0x7A = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (word_of_nat (length ys) + 0x7A))) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs ys s s'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length ys < unat word2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length ys); excaps_map ys = take (length ys) (array_to_list (excaprefs_C (current_extra_caps_' (globals s')))); pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; tcb_at' thread s; valid_ipc_buffer_ptr' x2 s; c_guard (PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + 0x1E8))) \<and> s' \<Turnstile>\<^sub>c PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + 0x1E8)) \<and> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(32 word) (x2 + (word_of_nat (length ys) * 4 + 0x1E8))) = xs ! length ys\<rbrakk> \<Longrightarrow> (word_of_nat (length ys) + 0x7A = 0 \<or> True) \<and> (word_of_nat (length ys) + 0x7A = 0 \<or> True)
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 10. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> (n < word2) = (n < word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 10. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 9. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?P'2819 infoa word1 word2 word3 word4 x2 lngth xs s) \<acute>cptr :== CALL getExtraCPtr_'proc(PTR(32 word) x2,\<acute>i);;
\<acute>lu_ret___struct_lookupSlot_raw_ret_C :== CALL lookupSlot_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
IF lookupSlot_raw_ret_C.status_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_fault :== CALL seL4_Fault_CapFault_new_'proc(\<acute>cptr,SCAST(32 signed \<rightarrow> 32) false);;
return_C ret__unsigned_long_'_update (\<lambda>s. lookupSlot_raw_ret_C.status_C (lu_ret___struct_lookupSlot_raw_ret_C_' s))
FI;;
Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) (lookupSlot_raw_ret_C.slot_C \<acute>lu_ret___struct_lookupSlot_raw_ret_C)) \<acute>current_extra_caps) (UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> {s} \<subseteq> ?P'2819 infoa word1 word2 word3 word4 x2 lngth xs s
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 9. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 10. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; s \<in> UNIV\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' sa)) False (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c (PTR(32 word) x2 +\<^sub>p uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' sa)) \<longrightarrow> - 2147483648 \<le> sint seL4_MsgMaxLength + sint 2 \<and> sint seL4_MsgMaxLength + sint 2 \<le> 2147483647 \<longrightarrow> ptr_add_assertion' (PTR(32 word) x2) (uint (SCAST(32 signed \<rightarrow> 32) (seL4_MsgMaxLength + 2) + i_' sa)) True (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> (\<forall>t. lookupSlot_raw_ret_C.status_C (ret__struct_lookupSlot_raw_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> i_' sa < 3 \<longrightarrow> i_' sa = i_' s)}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 8. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 9. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace> map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs ! n \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>m<length xs. user_word_at (xs ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) s)\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 10. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs n. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < unat word2\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s)\<rbrace> doE rv <- capFaultOnFailure (xs ! n) False (lookupSlotForThread thread (xs ! n));
do rva <- getSlotCap rv;
capFaultOnFailure (xs ! n) False (returnOk (rva, rv))
od
odE \<lbrace>\<lambda>_ s. valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s)\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 10. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs n s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; n < unat word2; valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s)\<rbrakk> \<Longrightarrow> True \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' x2 s \<and> (\<forall>m<unat word2. user_word_at (xs ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s)
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 7. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 8. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 10. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) < 2 ^ word_bits
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 6. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 7. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 9. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 10. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<forall>s f. current_extra_caps_' (globals (i_'_update f s)) = current_extra_caps_' (globals s) \<and> (i_'_update f s \<in> UNIV) = (s \<in> UNIV) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 8. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 9. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 10. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (i_' s, current_extra_caps_' (globals s))) rv' t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (11 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' (fst rv') t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat \<acute>i) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?y2942 infoa word1 word2 word3 word4 x2 lngth xs rv' t t')
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) (snd rv') t t' (?y2942 infoa word1 word2 word3 word4 x2 lngth xs rv' t t') (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 5. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 6. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 8. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 9. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 10. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv' t t'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) (snd rv') t t' (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF fst rv' < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>fst rv' < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) (unat (fst rv')) NULL) \<acute>current_extra_caps)
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (?d'2271 infoa word1 word2 word3 word4 x2 lngth xs rv')
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs))\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 lngth xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs rv rv') [SKIP] (returnOk rv) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF fst rv' < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>fst rv' < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) (unat (fst rv')) NULL) (snd rv'))
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word2\<rbrakk> \<Longrightarrow> ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (?Q2271 infoa word1 word2 word3 word4 x2 word2 xs rv) (?Q'2271 infoa word1 word2 word3 word4 x2 word2 xs rv rv') [SKIP] (returnOk rv) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF fst rv' < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>fst rv' < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) (unat (fst rv')) NULL) (snd rv'))
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>?Q2271 infoa word1 word2 word3 word4 x2 lngth xs\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v. ?Q'2271 infoa word1 word2 word3 word4 x2 lngth xs (theRight v))
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv'. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word2\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (length rv = length xs \<and> (\<forall>x\<in>set rv. snd x \<noteq> 0)) \<and> s \<in> \<lbrace>snd rv' = \<acute>current_extra_caps\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (IF fst rv' < 2 ^ unat seL4_MsgExtraCapBits - 1 THEN
  Guard ArrayBounds \<lbrace>fst rv' < 3\<rbrace> (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) (unat (fst rv')) NULL) (snd rv'))
FI));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (returnOk rv \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) rv (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))) s)}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs rv rv' \<sigma>. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; case rv' of (i', rv') \<Rightarrow> excaps_map rv = take (length rv) (array_to_list (excaprefs_C rv')) \<and> i' = word2\<rbrakk> \<Longrightarrow> {s. (length rv = length xs \<and> (\<forall>x\<in>set rv. snd x \<noteq> 0)) \<and> s \<in> \<lbrace>snd rv' = \<acute>current_extra_caps\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. 0 \<le>s seL4_MsgExtraCapBits \<and> seL4_MsgExtraCapBits <s 0x20 \<and> (fst rv' < 2 ^ unat seL4_MsgExtraCapBits - 1 \<longrightarrow> fst rv' < 3 \<and> (\<exists>(rv, \<sigma>')\<in>fst (returnOk rv \<sigma>). (\<sigma>', globals_update (current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>v. Arrays.update v (unat (fst rv')) NULL) (snd rv'))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) rv (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))) (globals_update (current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>v. Arrays.update v (unat (fst rv')) NULL) (snd rv'))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>)))) \<and> (\<not> fst rv' < 2 ^ unat seL4_MsgExtraCapBits - 1 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (returnOk rv \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) rv (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s))) (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))))}
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; excaps_map rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (word2 < 3 \<longrightarrow> interpret_excaps (excaprefs_C_update (\<lambda>v. Arrays.update v (unat word2) NULL) (current_extra_caps_' (globals x))) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))) \<and> (\<not> word2 < 3 \<longrightarrow> interpret_excaps (current_extra_caps_' (globals x)) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (Arrays.update (excaprefs_C (current_extra_caps_' (globals x))) (unat word2) NULL)) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))) \<and> (\<not> word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (Arrays.update (excaprefs_C (current_extra_caps_' (globals x))) (unat word2) NULL)) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))
 2. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<not> word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; word2 < 3\<rbrakk> \<Longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (map (index (Arrays.update (excaprefs_C (current_extra_caps_' (globals x))) (unat word2) NULL)) [0..<3]) = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3])
 2. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<not> word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x m. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; word2 < 3; m < unat word2\<rbrakk> \<Longrightarrow> ptr_val (excaprefs_C (current_extra_caps_' (globals x)).[m]) \<noteq> 0
 2. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<not> word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x m. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; word2 < 3; m < unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv ! m = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]) ! m\<rbrakk> \<Longrightarrow> ptr_val (excaprefs_C (current_extra_caps_' (globals x)).[m]) \<noteq> 0
 2. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<not> word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<not> word2 < 3 \<longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (array_to_list (excaprefs_C (current_extra_caps_' (globals x)))) = take (unat word2) (array_to_list (excaprefs_C (current_extra_caps_' (globals x))))
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; \<not> word2 < 3\<rbrakk> \<Longrightarrow> takeWhile (\<lambda>x. ptr_val x \<noteq> 0) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]) = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3])
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x m. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; \<not> word2 < 3; m < unat word2\<rbrakk> \<Longrightarrow> ptr_val (excaprefs_C (current_extra_caps_' (globals x)).[m]) \<noteq> 0
 2. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; \<not> word2 < 3; unat word2 < 3\<rbrakk> \<Longrightarrow> ptr_val (excaprefs_C (current_extra_caps_' (globals x)).[unat word2]) = 0
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x m. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; \<not> word2 < 3; m < unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv ! m = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]) ! m\<rbrakk> \<Longrightarrow> ptr_val (excaprefs_C (current_extra_caps_' (globals x)).[m]) \<noteq> 0
 2. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; \<not> word2 < 3; unat word2 < 3\<rbrakk> \<Longrightarrow> ptr_val (excaprefs_C (current_extra_caps_' (globals x)).[unat word2]) = 0
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs rv \<sigma> x. \<lbrakk>seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2; map (\<lambda>(cp, y). cte_Ptr y) rv = take (unat word2) (map (index (excaprefs_C (current_extra_caps_' (globals x)))) [0..<3]); length rv = unat word2; \<forall>x\<in>set rv. snd x \<noteq> 0; (\<sigma>, x) \<in> rf_sr; \<not> word2 < 3; unat word2 < 3\<rbrakk> \<Longrightarrow> ptr_val (excaprefs_C (current_extra_caps_' (globals x)).[unat word2]) = 0
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = length xs \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 3. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 6. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 7. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> sequenceE (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs) \<lbrace>\<lambda>a b. length a = unat word2 \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 3. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 6. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 7. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (8 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?R2276 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> mapME (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
rva <- liftE (getSlotCap rv);
capFaultOnFailure cptr False (returnOk (rva, rv))
odE) xs \<lbrace>\<lambda>a b. length a = unat word2 \<and> (\<forall>x\<in>set a. snd x \<noteq> 0)\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 3. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and ?R2276 infoa word1 word2 word2 word3 word4 x2 a and (\<lambda>_. length a = unat word2)\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 6. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and ?R2276 infoa word1 word2 v word3 word4 x2 rv and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 7. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>?P'3175 infoa word1 word2 word2 word3 word4 x2 xs\<rbrace> lookupSlotForThread thread x \<lbrace>\<lambda>rv s. rv \<noteq> 0\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs x y. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>a. True \<and> True \<and> ?P'3175 infoa word1 word2 word2 word3 word4 x2 xs a) and (\<lambda>a. snd x \<noteq> 0)\<rbrace> doE rv <- capFaultOnFailure y False (lookupSlotForThread thread y);
rva <- liftE (getSlotCap rv);
capFaultOnFailure y False (returnOk (rva, rv))
odE \<lbrace>\<lambda>_ a. snd x \<noteq> 0\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True \<and> True \<and> ?P'3175 infoa word1 word2 word2 word3 word4 x2 xs a\<rbrace> doE rv <- capFaultOnFailure x False (lookupSlotForThread thread x);
rva <- liftE (getSlotCap rv);
capFaultOnFailure x False (returnOk (rva, rv))
odE \<lbrace>\<lambda>_ a. True \<and> True \<and> ?P'3175 infoa word1 word2 word2 word3 word4 x2 xs a\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and (\<lambda>aa. length a = unat word2 \<and> True \<and> True \<and> ?P'3175 infoa word1 word2 word2 word3 word4 x2 a aa) and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> ?P'3175 infoa word1 word2 v word3 word4 x2 rv a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (10 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs x rv s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2; (no_0_obj' and real_cte_at' rv) s\<rbrakk> \<Longrightarrow> rv \<noteq> 0
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs x y. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>a. True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>a. snd x \<noteq> 0)\<rbrace> doE rv <- capFaultOnFailure y False (lookupSlotForThread thread y);
rva <- liftE (getSlotCap rv);
capFaultOnFailure y False (returnOk (rva, rv))
odE \<lbrace>\<lambda>_ a. snd x \<noteq> 0\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True \<and> True \<and> no_0_obj' a \<and> valid_objs' a\<rbrace> doE rv <- capFaultOnFailure x False (lookupSlotForThread thread x);
rva <- liftE (getSlotCap rv);
capFaultOnFailure x False (returnOk (rva, rv))
odE \<lbrace>\<lambda>_ a. True \<and> True \<and> no_0_obj' a \<and> valid_objs' a\<rbrace>, -
 4. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 5. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and (\<lambda>aa. length a = unat word2 \<and> True \<and> True \<and> no_0_obj' aa \<and> valid_objs' aa) and (\<lambda>_. length a = unat word2)\<rbrace>
 7. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 8. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 9. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (9 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth xs x y. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>a. True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>a. snd x \<noteq> 0)\<rbrace> doE rv <- capFaultOnFailure y False (lookupSlotForThread thread y);
rva <- liftE (getSlotCap rv);
capFaultOnFailure y False (returnOk (rva, rv))
odE \<lbrace>\<lambda>_ a. snd x \<noteq> 0\<rbrace>, -
 2. \<And>infoa word1 word2 word3 word4 x2 lngth xs x. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True \<and> True \<and> no_0_obj' a \<and> valid_objs' a\<rbrace> doE rv <- capFaultOnFailure x False (lookupSlotForThread thread x);
rva <- liftE (getSlotCap rv);
capFaultOnFailure x False (returnOk (rva, rv))
odE \<lbrace>\<lambda>_ a. True \<and> True \<and> no_0_obj' a \<and> valid_objs' a\<rbrace>, -
 3. \<And>infoa word1 word2 word3 word4 x2 lngth xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word_of_nat (length (map (\<lambda>cptr. doE rv <- capFaultOnFailure cptr False (lookupSlotForThread thread cptr);
do rva <- getSlotCap rv;
capFaultOnFailure cptr False (returnOk (rva, rv))
od
odE) xs)))) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 4. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and (\<lambda>aa. length a = unat word2 \<and> True \<and> True \<and> no_0_obj' aa \<and> valid_objs' aa) and (\<lambda>_. length a = unat word2)\<rbrace>
 6. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 7. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 8. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (7 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 xs. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; length xs = unat word2\<rbrakk> \<Longrightarrow> guard_is_UNIV (inr_rrel (\<lambda>a (i', rv'). excaps_map a = take (length a) (array_to_list (excaprefs_C rv')) \<and> i' = word2)) (\<lambda>a. (i_' a, current_extra_caps_' (globals a))) (\<lambda>v a. \<lbrace>snd a = \<acute>current_extra_caps\<rbrace>)
 2. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and (\<lambda>aa. length a = unat word2 \<and> True \<and> True \<and> no_0_obj' aa \<and> valid_objs' aa) and (\<lambda>_. length a = unat word2)\<rbrace>
 4. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 5. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 6. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (6 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?R1737 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>a. (\<lambda>aa. valid_pspace' aa \<and> tcb_at' thread aa \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) aa \<and> (\<forall>m<length a. user_word_at (a ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) aa)) and (\<lambda>aa. length a = unat word2 \<and> True \<and> True \<and> no_0_obj' aa \<and> valid_objs' aa) and (\<lambda>_. length a = unat word2)\<rbrace>
 3. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 4. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 5. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; ?R1737 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> ?R1737 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (5 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> \<lbrace>?P'3272 infoa (PTR(32 word) x2) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2\<rbrace> mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<lbrace>\<lambda>rv s. (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat word2 \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat word2\<rbrace>
 2. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 3. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 4. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> ?P'3272 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>xd. buffer = Some xd \<longrightarrow> valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> ?P'3272 infoa bufferPtr threada x xa xb xc xd s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (4 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 lngth. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = \<lparr>label_CL = word4, capsUnwrapped_CL = word3, extraCaps_CL = word2, length_CL = word1\<rparr>; info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; lngth = word2\<rbrakk> \<Longrightarrow> empty_fail (mapM loadWordUser (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]))
 2. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 3. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>rv. (\<forall>x<length (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]). user_word_at (rv ! x) (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2] ! x) s) \<and> length rv = length (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<longrightarrow> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat word2 \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat word2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>x. buffer = Some x \<longrightarrow> valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>rv. (\<forall>xb<length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]). user_word_at (rv ! xb) (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa] ! xb) s) \<and> length rv = length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]) \<longrightarrow> (\<forall>m<length rv. user_word_at (rv ! m) (x + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat xa \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat xa))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (3 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s. \<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. infoa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) s \<longrightarrow> s' \<in> {s. s\<lparr>length___unsigned_long_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>excaps_map [] = take (length []) (array_to_list (excaprefs_C \<acute>current_extra_caps))\<rbrace> \<inter> UNIV}}}
 2. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>rv. (\<forall>x<length (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]). user_word_at (rv ! x) (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2] ! x) s) \<and> length rv = length (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<longrightarrow> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat word2 \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat word2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?R''1660 infoa (option_to_ptr (Some x2)) (tcb_ptr_to_ctcb_ptr thread) word1 word2 word3 word4 x2 \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>x. buffer = Some x \<longrightarrow> valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>rv. (\<forall>xb<length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]). user_word_at (rv ! xb) (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa] ! xb) s) \<and> length rv = length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]) \<longrightarrow> (\<forall>m<length rv. user_word_at (rv ! m) (x + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat xa \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat xa))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xd. s \<in> {s. buffer = Some xd \<longrightarrow> s \<in> ?R''1660 infoa bufferPtr threada x xa xb xc xd}}}}}}} proof (prove)
goal (2 subgoals):
 1. \<And>infoa word1 word2 word3 word4 x2 s. \<lbrakk>unat word2 \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI word1 word2 word3 word4); info = Types_H.message_info.MI word1 word2 word3 word4; buffer = Some x2; valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>rv. (\<forall>x<length (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]). user_word_at (rv ! x) (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2] ! x) s) \<and> length rv = length (map (\<lambda>x. x2 + (x + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. word2]) \<longrightarrow> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat word2 \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat word2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (option_to_ptr (Some x2) = NULL \<longrightarrow> False) \<and> (option_to_ptr (Some x2) \<noteq> NULL \<longrightarrow> (\<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift infoa) \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x2 + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) sa \<longrightarrow> (True \<and> excaps_map [] = take (length []) (array_to_list (excaprefs_C (current_extra_caps_' (globals s))))) \<and> True)))} \<inter> {s'. (s, s') \<in> rf_sr}) IF option_to_ptr (Some x2) = NULL THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)
FI {s'. (s, s') \<in> rf_sr}
 2. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>x. buffer = Some x \<longrightarrow> valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>rv. (\<forall>xb<length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]). user_word_at (rv ! xb) (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa] ! xb) s) \<and> length rv = length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]) \<longrightarrow> (\<forall>m<length rv. user_word_at (rv ! m) (x + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat xa \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat xa))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. buffer = Some x \<longrightarrow> s \<in> {s. (bufferPtr = NULL \<longrightarrow> False) \<and> (bufferPtr \<noteq> NULL \<longrightarrow> (\<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift infoa) \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) sa \<longrightarrow> (True \<and> excaps_map [] = take (length []) (array_to_list (excaprefs_C (current_extra_caps_' (globals s))))) \<and> True)))}}}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>infoa bufferPtr threada s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; bufferPtr = option_to_ptr buffer; threada = tcb_ptr_to_ctcb_ptr thread; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (buffer = None \<longrightarrow> True) \<and> (\<forall>x. buffer = Some x \<longrightarrow> valid_pspace' s \<and> tcb_at' thread s \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (\<forall>rv. (\<forall>xb<length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]). user_word_at (rv ! xb) (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa] ! xb) s) \<and> length rv = length (map (\<lambda>xa. x + (xa + (msgMaxLength + 1)) * word_of_nat wordSize) [1 , 2 .e. xa]) \<longrightarrow> (\<forall>m<length rv. user_word_at (rv ! m) (x + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat xa \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat xa))) \<and> s' \<in> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> s \<in> {s. buffer = None \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. buffer = Some x \<longrightarrow> s \<in> {s. (bufferPtr = NULL \<longrightarrow> False) \<and> (bufferPtr \<noteq> NULL \<longrightarrow> (\<forall>v. v = extraCaps_CL (seL4_MessageInfo_lift infoa) \<longrightarrow> (\<forall>rv sa. (sa, s\<lparr>ret__unsigned_' := v\<rparr>) \<in> rf_sr \<and> ((\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> (case buffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> (\<forall>m<length rv. user_word_at (rv ! m) (x + (word_of_nat m + (msgMaxLength + 2)) * 4) a)) and (\<lambda>a. length rv = unat v \<and> True \<and> True \<and> no_0_obj' a \<and> valid_objs' a) and (\<lambda>_. length rv = unat v)) sa \<longrightarrow> (True \<and> excaps_map [] = take (length []) (array_to_list (excaprefs_C (current_extra_caps_' (globals s))))) \<and> True)))}}}}}}}} proof (prove)
goal (1 subgoal):
 1. \<And>infoa s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' thread s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> (\<forall>x xa. (\<exists>xb xc. info = Types_H.message_info.MI x xa xb xc) \<longrightarrow> (\<forall>x. buffer = Some x \<longrightarrow> valid_ipc_buffer_ptr' x s \<and> (\<forall>rv. (\<forall>xb<length [1 , 2 .e. xa]. user_word_at (rv ! xb) (x + ([1 , 2 .e. xa] ! xb + (msgMaxLength + 1)) * word_of_nat wordSize) s) \<and> length rv = length [1 , 2 .e. xa] \<longrightarrow> (\<forall>m<length [1 , 2 .e. xa]. user_word_at (rv ! m) (x + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length [1 , 2 .e. xa] = unat xa \<and> no_0_obj' s \<and> valid_objs' s \<and> length [1 , 2 .e. xa] = unat xa))) \<and> (\<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (\<forall>xd. buffer = Some xd \<longrightarrow> option_to_ptr (Some xd) \<noteq> NULL \<and> (option_to_ptr (Some xd) \<noteq> NULL \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' xd s \<and> (\<forall>m<length rv. user_word_at (rv ! m) (xd + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc))) \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc)))) \<longrightarrow> excaps_map [] = []))) proof (prove)
goal (2 subgoals):
 1. \<And>infoa s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' thread s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> \<forall>x xa. (\<exists>xb xc. info = Types_H.message_info.MI x xa xb xc) \<longrightarrow> (\<forall>x. buffer = Some x \<longrightarrow> valid_ipc_buffer_ptr' x s \<and> (\<forall>rv. (\<forall>xb<length [1 , 2 .e. xa]. user_word_at (rv ! xb) (x + ([1 , 2 .e. xa] ! xb + (msgMaxLength + 1)) * word_of_nat wordSize) s) \<and> length rv = length [1 , 2 .e. xa] \<longrightarrow> (\<forall>m<length [1 , 2 .e. xa]. user_word_at (rv ! m) (x + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length [1 , 2 .e. xa] = unat xa \<and> no_0_obj' s \<and> valid_objs' s \<and> length [1 , 2 .e. xa] = unat xa))
 2. \<And>infoa s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' thread s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> \<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (\<forall>xd. buffer = Some xd \<longrightarrow> option_to_ptr (Some xd) \<noteq> NULL \<and> (option_to_ptr (Some xd) \<noteq> NULL \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' xd s \<and> (\<forall>m<length rv. user_word_at (rv ! m) (xd + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc))) \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc)))) \<longrightarrow> excaps_map [] = [])) proof (prove)
goal (2 subgoals):
 1. \<And>infoa s s' x xa xb xc xd rv. \<lbrakk>unat xa \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI x xa xb xc); (s, s') \<in> rf_sr; tcb_at' thread s; valid_ipc_buffer_ptr' xd s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; info = Types_H.message_info.MI x xa xb xc; buffer = Some xd; \<forall>x<length [1 , 2 .e. xa]. user_word_at (rv ! x) (xd + ([1 , 2 .e. xa] ! x + (msgMaxLength + 1)) * word_of_nat wordSize) s; length rv = length [1 , 2 .e. xa]\<rbrakk> \<Longrightarrow> (\<forall>m<length [1 , 2 .e. xa]. user_word_at (rv ! m) (xd + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length [1 , 2 .e. xa] = unat xa
 2. \<And>infoa s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' thread s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> \<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (\<forall>xd. buffer = Some xd \<longrightarrow> option_to_ptr (Some xd) \<noteq> NULL \<and> (option_to_ptr (Some xd) \<noteq> NULL \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' xd s \<and> (\<forall>m<length rv. user_word_at (rv ! m) (xd + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc))) \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc)))) \<longrightarrow> excaps_map [] = [])) proof (prove)
goal (2 subgoals):
 1. \<And>infoa s s' x xa xb xc xd rv. \<lbrakk>length rv = unat xa; unat xa \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H (Types_H.message_info.MI x xa xb xc); (s, s') \<in> rf_sr; tcb_at' thread s; valid_ipc_buffer_ptr' xd s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; info = Types_H.message_info.MI x xa xb xc; buffer = Some xd; xa \<noteq> 0; \<forall>x<unat xa. user_word_at (rv ! x) (xd + (2 + ([0 .e. xa - 1] ! x + msgMaxLength)) * word_of_nat wordSize) s\<rbrakk> \<Longrightarrow> \<forall>m<unat xa. user_word_at (rv ! m) (xd + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s
 2. \<And>infoa s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' thread s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> \<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (\<forall>xd. buffer = Some xd \<longrightarrow> option_to_ptr (Some xd) \<noteq> NULL \<and> (option_to_ptr (Some xd) \<noteq> NULL \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' xd s \<and> (\<forall>m<length rv. user_word_at (rv ! m) (xd + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc))) \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc)))) \<longrightarrow> excaps_map [] = [])) proof (prove)
goal (1 subgoal):
 1. \<And>infoa s s'. \<lbrakk>unat (msgExtraCaps info) \<le> 3; seL4_MessageInfo_lift infoa = mi_from_H info; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' thread s; (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> \<forall>x xa xb xc. info = Types_H.message_info.MI x xa xb xc \<longrightarrow> (\<forall>xd. buffer = Some xd \<longrightarrow> option_to_ptr (Some xd) \<noteq> NULL \<and> (option_to_ptr (Some xd) \<noteq> NULL \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_ipc_buffer_ptr' xd s \<and> (\<forall>m<length rv. user_word_at (rv ! m) (xd + (word_of_nat m * 4 + (msgMaxLength * 4 + 8))) s) \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc))) \<and> no_0_obj' s \<and> valid_objs' s \<and> length rv = unat (extraCaps_CL (mi_from_H (Types_H.message_info.MI x xa xb xc)))) \<longrightarrow> excaps_map [] = [])) proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres ((\<lambda>ft _ err. cfault_rel (Some ft) (errfault err) (errlookup_fault err)) \<currency> (\<lambda>xs ys. interpret_excaps ys = excaps_map xs)) (liftxf errstate fst snd (\<lambda>s. (ret__unsigned_long_' s, current_extra_caps_' (globals s)))) (valid_pspace' and tcb_at' thread and (case buffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps info) \<le> 3)) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr buffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H info\<rbrace>) [] (lookupExtraCaps thread buffer info) (Call lookupExtraCaps_'proc)

goal:
No subgoals!