theory SyscallArgs_C

lemma lookupIPCBuffer_ccorres[corres]:
  "ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_'
           (tcb_at' t)
           (UNIV \<inter> {s. thread_' s = tcb_ptr_to_ctcb_ptr t}
                  \<inter> {s. isReceiver_' s = from_bool isReceiver}) []
      (lookupIPCBuffer isReceiver t) (Call lookupIPCBuffer_'proc)" apply (cinit lift: thread_' isReceiver_') apply (rule ccorres_split_nothrow) apply simp apply (rule threadGet_tcbIpcBuffer_ccorres) apply ceqv apply (simp add: getThreadBufferSlot_def locateSlot_conv
                      cte_C_size word_sle_def Collect_True
                 del: Collect_const) apply ccorres_remove_UNIV_guard apply (rule ccorres_getSlotCap_cte_at) apply (rule ccorres_move_array_assertion_tcb_ctes
                 ccorres_move_c_guard_tcb_ctes)+ apply (ctac (no_vcg)) apply (rename_tac bufferCap bufferCap') apply csymbr apply (rule_tac b="isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)"
                in ccorres_case_bools') apply simp apply (rule ccorres_symb_exec_r) apply (rule_tac b="capVPSize (capCap bufferCap) \<noteq> ARMSmallPage" in ccorres_case_bools') apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (rule ccorres_cond_false_seq) apply (simp(no_asm)) apply csymbr apply (rule_tac b="isDeviceCap bufferCap" in ccorres_case_bools') apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg,
                   clarsimp simp: isCap_simps return_def option_to_ptr_def option_to_0_def) apply (rule ccorres_cond_false_seq) apply simp apply csymbr apply (clarsimp simp: isCap_simps) apply (rule ccorres_guard_imp[where A=\<top> and A'=UNIV],
                  rule ccorres_cond [where R=\<top>]) apply (clarsimp simp: from_bool_0 isCap_simps) apply (frule ccap_relation_PageCap_generics) apply clarsimp apply (clarsimp simp: vmrights_to_H_def) apply (simp add: Kernel_C.VMReadOnly_def Kernel_C.VMKernelOnly_def
                                Kernel_C.VMReadWrite_def Kernel_C.VMNoAccess_def
                         split: if_split) apply clarsimp apply (drule less_4_cases) apply auto[1] apply (frule cap_get_tag_isCap_unfolded_H_cap(17),simp) apply (frule capFVMRights_range) apply (simp add: cap_frame_cap_lift
                               generic_frame_cap_get_capFVMRights_CL_def) apply (clarsimp simp: cap_to_H_def vmrights_to_H_def
                               word_le_make_less Kernel_C.VMNoAccess_def
                               Kernel_C.VMReadWrite_def Kernel_C.VMReadOnly_def
                               Kernel_C.VMKernelOnly_def
                               dest: word_less_cases) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply csymbr apply csymbr apply (rule ccorres_Guard) apply simp apply (rule ccorres_assert)+ apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def option_to_ptr_def option_to_0_def isCap_simps) apply (clarsimp dest!: ccap_relation_PageCap_generics simp: mask_def) apply (ctac add: ccorres_return_C) apply clarsimp apply (clarsimp simp: if_1_0_0 Collect_const_mem isCap_simps word_less_nat_alt
              option_to_ptr_def from_bool_0 option_to_0_def dest!:ccap_relation_frame_tags) apply (rule ccorres_cond_false_seq) apply (simp(no_asm)) apply (rule ccorres_cond_false_seq) apply (simp(no_asm)) apply csymbr apply (rule_tac b="isDeviceCap bufferCap" in ccorres_case_bools') apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg,
                    clarsimp simp: isCap_simps return_def
                                   option_to_ptr_def option_to_0_def) apply (rule ccorres_cond_false_seq) apply simp apply csymbr apply (clarsimp simp: isCap_simps) apply (rule ccorres_guard_imp[where A=\<top> and A'=UNIV],
                rule ccorres_cond [where R=\<top>]) apply (clarsimp simp: from_bool_0 isCap_simps) apply (frule ccap_relation_PageCap_generics) apply clarsimp apply (clarsimp simp: vmrights_to_H_def) apply (simp add: Kernel_C.VMReadOnly_def Kernel_C.VMKernelOnly_def
                                 Kernel_C.VMReadWrite_def Kernel_C.VMNoAccess_def
                          split: if_split) apply clarsimp apply (drule less_4_cases) apply auto[1] apply (frule cap_get_tag_isCap_unfolded_H_cap(16),simp) apply (frule capFVMRights_range) apply (simp add: cap_frame_cap_lift
                                generic_frame_cap_get_capFVMRights_CL_def) apply (clarsimp simp: cap_to_H_def vmrights_to_H_def
                                      word_le_make_less Kernel_C.VMNoAccess_def
                                      Kernel_C.VMReadWrite_def Kernel_C.VMReadOnly_def
                                      Kernel_C.VMKernelOnly_def
                                dest: word_less_cases) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply csymbr apply csymbr apply (rule ccorres_Guard) apply simp apply (rule ccorres_assert)+ apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def option_to_ptr_def option_to_0_def isCap_simps) apply (clarsimp dest!: ccap_relation_PageCap_generics simp: mask_def) apply (ctac add: ccorres_return_C) apply clarsimp apply (clarsimp simp: if_1_0_0 Collect_const_mem isCap_simps word_less_nat_alt
               option_to_ptr_def option_to_0_def dest!:ccap_relation_frame_tags) apply (clarsimp simp: from_bool_0) apply vcg apply clarsimp apply (rule conseqPre, vcg) apply (clarsimp simp: from_bool_0 isCap_simps Collect_const_mem) apply (simp (no_asm)) apply (rule ccorres_symb_exec_r) apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (rule ccorres_cond_true_seq) apply simp apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def option_to_ptr_def option_to_0_def isCap_simps
                               dumb_bool_for_all
                        split: capability.splits arch_capability.splits bool.splits) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply clarsimp apply wp apply (clarsimp simp: Collect_const_mem) apply (rule conjI) apply (clarsimp simp: isCap_simps word_less_nat_alt ) apply (frule ccap_relation_page_is_device) apply (frule ccap_relation_PageCap_generics) apply (frule ccap_relation_frame_tags) apply clarsimp apply (rule conjI,clarsimp) apply (clarsimp simp: cap_get_tag_PageCap_small_frame cap_frame_cap_lift
                       split: if_splits) apply (erule disjE) apply ((clarsimp simp: cap_small_frame_cap_lift cap_get_tag_PageCap_frame
                              cap_get_tag_PageCap_small_frame
                       split: if_splits)+)[2] apply (rule ccontr) apply clarsimp apply (erule disjE) apply ((fastforce simp: cap_get_tag_PageCap_frame
                              cap_get_tag_PageCap_small_frame isCap_simps)+)[2] apply wp apply vcg apply (simp add: word_sle_def Collect_const_mem
                   tcb_cnode_index_defs tcbSlots cte_level_bits_def
                   size_of_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (tcb_at' t) (UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr t\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool isReceiver\<rbrace>) [] (lookupIPCBuffer isReceiver t) (Call lookupIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q1628 isReceivera thread) (?Q'1628 isReceivera thread) [SKIP] (do bufferPtr <- threadGet tcbIPCBuffer t;
bufferFrameSlot <- getThreadBufferSlot t;
bufferCap <- getSlotCap bufferFrameSlot;
case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz x) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz x) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return Nothing | _ \<Rightarrow> return Nothing
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C''])));;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> isReceivera = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (w_bufferPtr_' s && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))))))
 2. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1628 isReceivera thread s \<and> s' \<in> ?Q'1628 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> ccorres (?r'1634 isReceivera thread) (?xf'1634 isReceivera thread) (?P1634 isReceivera thread) (?P'1634 isReceivera thread) [SKIP] (threadGet tcbIPCBuffer t) (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))))
 2. \<And>isReceivera thread rv' ta t'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1634 isReceivera thread) rv' ta t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> isReceivera = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (w_bufferPtr_' s && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))))) (?d'1634 isReceivera thread rv')
 3. \<And>isReceivera thread bufferPtr rv'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; ?r'1634 isReceivera thread bufferPtr rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q1634 isReceivera thread bufferPtr) (?Q'1634 isReceivera thread bufferPtr rv') [SKIP] (do bufferFrameSlot <- getThreadBufferSlot t;
bufferCap <- getSlotCap bufferFrameSlot;
case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz x) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz x) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return Nothing | _ \<Rightarrow> return Nothing
od) (?d'1634 isReceivera thread rv')
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>?Q1634 isReceivera thread\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. ?r'1634 isReceivera thread bufferPtr (?xf'1634 isReceivera thread s) \<longrightarrow> s \<in> ?Q'1634 isReceivera thread bufferPtr (?xf'1634 isReceivera thread s)}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1634 isReceivera thread and ?R1634 isReceivera thread) s \<and> s' \<in> ?P'1634 isReceivera thread \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> ccorres (?r'1634 isReceivera thread) (?xf'1634 isReceivera thread) (?P1634 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t)) (?P'1634 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t)) [SKIP] (threadGet tcbIPCBuffer t) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr t} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(tcb_ptr_to_ctcb_ptr t\<rightarrow>[''tcbIPCBuffer_C'']))))
 2. \<And>isReceivera thread rv' ta t'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1634 isReceivera thread) rv' ta t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> isReceivera = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (w_bufferPtr_' s && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))))) (?d'1634 isReceivera thread rv')
 3. \<And>isReceivera thread bufferPtr rv'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; ?r'1634 isReceivera thread bufferPtr rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q1634 isReceivera thread bufferPtr) (?Q'1634 isReceivera thread bufferPtr rv') [SKIP] (do bufferFrameSlot <- getThreadBufferSlot t;
bufferCap <- getSlotCap bufferFrameSlot;
case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz x) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz x) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return Nothing | _ \<Rightarrow> return Nothing
od) (?d'1634 isReceivera thread rv')
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>?Q1634 isReceivera thread\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. ?r'1634 isReceivera thread bufferPtr (?xf'1634 isReceivera thread s) \<longrightarrow> s \<in> ?Q'1634 isReceivera thread bufferPtr (?xf'1634 isReceivera thread s)}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1634 isReceivera thread and ?R1634 isReceivera thread) s \<and> s' \<in> ?P'1634 isReceivera thread \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>isReceivera thread rv' ta t'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> ceqv \<Gamma> w_bufferPtr_' rv' ta t' (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> isReceivera = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (w_bufferPtr_' s && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))))) (?d'1634 isReceivera thread rv')
 2. \<And>isReceivera thread bufferPtr rv'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q1634 isReceivera thread bufferPtr) (?Q'1634 isReceivera thread bufferPtr rv') [SKIP] (do bufferFrameSlot <- getThreadBufferSlot t;
bufferCap <- getSlotCap bufferFrameSlot;
case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz x) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz x) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return Nothing | _ \<Rightarrow> return Nothing
od) (?d'1634 isReceivera thread rv')
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>?Q1634 isReceivera thread\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> ?Q'1634 isReceivera thread bufferPtr (w_bufferPtr_' s)}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>isReceivera thread bufferPtr rv'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q1634 isReceivera thread bufferPtr) (?Q'1634 isReceivera thread bufferPtr rv') [SKIP] (do bufferFrameSlot <- getThreadBufferSlot t;
bufferCap <- getSlotCap bufferFrameSlot;
case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz x) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz x) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return Nothing | _ \<Rightarrow> return Nothing
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val thread && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> isReceivera = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))))
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>?Q1634 isReceivera thread\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> ?Q'1634 isReceivera thread bufferPtr (w_bufferPtr_' s)}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>isReceivera thread bufferPtr rv'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q1634 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv') (?Q'1634 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv') [SKIP] (getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) >>= case_capability (\<lambda>word. return None) (return None) (\<lambda>word1 word2 bool1 bool2. return None) (\<lambda>word. return None) (\<lambda>word1 word2 bool1 bool2 bool3 bool4. return None) (return None) (\<lambda>word zombie_type nat. return None) (case_arch_capability (\<lambda>word1 word2. return None) (return None) (\<lambda>bool baseptr rights sz x. case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od) (\<lambda>word option. return None) (\<lambda>word option. return None)) (\<lambda>word bool1 bool2. return None) (\<lambda>bool word nat1 nat2. return None) (\<lambda>word1 nat1 word2 nat2. return None) (return None)) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10)} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10)\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))))
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>?Q1634 isReceivera thread\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> ?Q'1634 isReceivera thread bufferPtr (w_bufferPtr_' s)}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q1634 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv') (?G'2075 rv' rv'a) [SKIP] (getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) >>= case_capability (\<lambda>word. return None) (return None) (\<lambda>word1 word2 bool1 bool2. return None) (\<lambda>word. return None) (\<lambda>word1 word2 bool1 bool2 bool3 bool4. return None) (return None) (\<lambda>word zombie_type nat. return None) (case_arch_capability (\<lambda>word1 word2. return None) (return None) (\<lambda>bool baseptr rights sz x. case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od) (\<lambda>word option. return None) (\<lambda>word option. return None)) (\<lambda>word bool1 bool2. return None) (\<lambda>bool word nat1 nat2. return None) (\<lambda>word1 nat1 word2 nat2. return None) (return None)) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10)} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10)\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))))
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>?Q1634 isReceivera thread\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {sa. sa \<in> ?G'2074 isReceivera thread bufferPtr (w_bufferPtr_' s)}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread
flex-flex pairs:
\<lambda>rv'. ?G'2075 rv' () \<equiv>\<^sup>? \<lambda>rv'. ?G'2074 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' proof (prove)
goal (4 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?G2301 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv') (?G'2075 rv' rv'a) [SKIP] (do a <- getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot);
case a of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None
od) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10)} (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00)) (sint tcbBuffer) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10)\<rightarrow>[''cap_C''])))));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))))
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ?G2301 isReceivera thread a b\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {sa. sa \<in> ?G'2074 isReceivera thread bufferPtr (w_bufferPtr_' s)}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread
flex-flex pairs:
\<lambda>rv'. ?G'2075 rv' () \<equiv>\<^sup>? \<lambda>rv'. ?G'2074 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' proof (prove)
goal (4 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?A2326 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv') (?C'2325 rv' rv'a) [SKIP] (do a <- getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot);
case a of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None
od) (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr ((ptr_val (tcb_ptr_to_ctcb_ptr t) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10)\<rightarrow>[''cap_C'']));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(\<acute>bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(\<acute>bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(\<acute>bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(\<acute>bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))))
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> (?A2326 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {sa. sa \<in> ?C'2324 isReceivera thread bufferPtr (w_bufferPtr_' s) \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread
flex-flex pairs:
\<lambda>rv'. ?C'2325 rv' () \<equiv>\<^sup>? \<lambda>rv'. ?C'2324 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a rv bufferCap. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2333 isReceivera thread bufferPtr rv' rv'a rv) (?Q'2333 isReceivera thread bufferPtr rv' rv'a rv bufferCap) [SKIP] (case rv of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap);;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap);;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap);;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))))
 2. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>?Q2333 isReceivera thread bufferPtr rv' rv'a\<rbrace>
 3. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2333 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s)
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2333 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2333 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap') [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))))
 2. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>?Q2333 isReceivera thread bufferPtr rv' rv'a\<rbrace>
 3. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2333 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s)
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2333 isReceivera thread bufferPtr rv' rv'a bufferCap) (?G'2756 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>?Q2333 isReceivera thread bufferPtr rv' rv'a\<rbrace>
 3. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2756 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (7 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2911 isReceivera thread bufferPtr rv' rv'a bufferCap) (?P'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> ?P2911 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 4. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 7. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (7 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2911 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> ?P2911 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 4. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 7. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2911 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2918 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) (?Q'2918 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); ?P2911 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> ?P2911 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?P'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?P'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'2939 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?R'2939 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'2939 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?R'2939 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?G'2950 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2950 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?G'3287 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?G'3287 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'3610 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (SKIP;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?R'3610 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'3610 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?R'3610 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?G'3622 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'3622 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?P2936 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (11 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P3863 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?P'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> ?P'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> ?P3863 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 6. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> ?P3863 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 8. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P3863 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'3866 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL);;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> ?R'3866 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> ?P3863 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 6. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> ?P3863 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 8. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3869 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL) {},UNIV
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long \<sigma>. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' s)}
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> ?R'3869 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long \<sigma>. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' s)}
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 6. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 8. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'3853 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'3902 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (SKIP;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?R'3902 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va \<inter> - \<lbrace>va \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'3902 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' bufferCap bufferCap' (cap_get_tag bufferCap') (cap_get_tag bufferCap') (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?R'3902 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va \<inter> - \<lbrace>va \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned ret__unsigned_long vm_rights. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned = cap_get_tag bufferCap'; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap; vm_rights = generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?G'3925 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' bufferCap bufferCap' (cap_get_tag bufferCap') (cap_get_tag bufferCap') (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')) vm_rights) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>vb. vb = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. vb) s \<in> ?G'3925 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va vb} \<inter> - \<lbrace>va \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3))) (?G'3925 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap' (cap_get_tag bufferCap') (cap_get_tag bufferCap') (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')) (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap'))) [SKIP] (if v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly then do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing) (Cond (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>va \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>vb. vb = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. vb) s \<in> ?G'3925 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va vb} \<inter> - \<lbrace>va \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q3862 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q3862 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (14 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>bufferCap' d v0a v1 v2 v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>bufferCap' d v0a v1 v2 v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; (s, s') \<in> rf_sr; (v3 \<noteq> None \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3)) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None) \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')) = v1 \<and> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) = v2 \<and> generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') = v0a \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4 \<and> generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4 \<and> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')) = False\<rbrakk> \<Longrightarrow> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap'))) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) v3)) bufferCap'; gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) \<noteq> Wellformed_C.ARMSmallPage; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))\<rbrakk> \<Longrightarrow> (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')) = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')) = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMNoAccess then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) v3)) bufferCap'; gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) \<noteq> Wellformed_C.ARMSmallPage; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))\<rbrakk> \<Longrightarrow> ((if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMNoAccess then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMNoAccess then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 0 then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) v3)) bufferCap'; gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) \<noteq> Wellformed_C.ARMSmallPage; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))\<rbrakk> \<Longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 2 \<longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 1 \<longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 0 \<longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) v3)) bufferCap'; gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) \<noteq> Wellformed_C.ARMSmallPage; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 2; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 1; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 0\<rbrakk> \<Longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) v3)) bufferCap'; gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) \<noteq> Wellformed_C.ARMSmallPage; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 2; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 1; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 0; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 0 \<or> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 1 \<or> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 2 \<or> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3\<rbrakk> \<Longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 8. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 9. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 10. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') \<le> 3\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' d v0a v1 v2 v3) (?Rt4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize v2)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') \<le> 3\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?Rt4150 rv' bufferCap' False v0a v1 v2 v3) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?Rt4150 rv' bufferCap' False v0a v1 v2 v3) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?Rt4150 rv' bufferCap' False v0a v1 v2 v3) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
(lvar_nondet_init pageBits_' pageBits_'_update;;
(\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))))))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?G'4228 rv' bufferCap' False v0a v1 v2 v3) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (lvar_nondet_init pageBits_' pageBits_'_update;;
(\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> ?G'4228 rv' bufferCap' d v0a v1 v2 v3} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?G'4247 rv' bufferCap' False v0a v1 v2 v3) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> ?G'4247 rv' bufferCap' d v0a v1 v2 v3}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?G'4270 rv' bufferCap' False v0a v1 v2 v3 basePtr) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat (pageBits_' s) - 1)))))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> ?G'4270 rv' bufferCap' d v0a v1 v2 v3 v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?G'4398 rv' bufferCap' False v0a v1 v2 v3 basePtr ret__unsigned_long) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat (pageBits_' s) - 1))))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'4398 rv' bufferCap' d v0a v1 v2 v3 v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?G'4495 rv' bufferCap' False v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (\<acute>pageBits :== unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> ?G'4495 rv' bufferCap' d v0a v1 v2 v3 v va vb}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?G'4566 rv' bufferCap' False v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (Guard ShiftError \<lbrace>unsigned_long_eret_2 < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat unsigned_long_eret_2 - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?G'4566 rv' bufferCap' d v0a v1 v2 v3 v va vb}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?C'4611 rv' bufferCap' False v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat unsigned_long_eret_2 - 1))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?C'4611 rv' bufferCap' d v0a v1 v2 v3 v va vb \<inter> \<lbrace>vb < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))))))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?C'4611 rv' bufferCap' False v0a v1 v2 v3 (generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))) (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))) (word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))))))) [SKIP] (do y <- assert (v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0);
return (Some (v0a + (rv' && mask (pageBitsForSize v2))))
od) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))) + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))))) - 1))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?C'4611 rv' bufferCap' d v0a v1 v2 v3 v va vb \<inter> \<lbrace>vb < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))))); v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt4150 rv' bufferCap' False v0a v1 v2 v3) (?C'4611 rv' bufferCap' False v0a v1 v2 v3 (generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))) (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))) (word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))))))) [SKIP] (return (Some (v0a + (rv' && mask (pageBitsForSize v2))))) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))) + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))))) - 1))))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt4150 rv' bufferCap' d v0a v1 v2 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?C'4611 rv' bufferCap' d v0a v1 v2 v3 v va vb \<inter> \<lbrace>vb < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))))); v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))) + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))))) - 1))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Some (v0a + (rv' && mask (pageBitsForSize v2)))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' s)}
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 basePtr ret__unsigned_long unsigned_long_eret_2 \<sigma>. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')))))); v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Some (v0a + (rv' && mask (pageBitsForSize v2)))) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_unsigned_long_' := PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))) + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))))) - 1)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> option_to_ptr rv = PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))) + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))))) - 1))}
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 \<sigma> x. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; cap_lift bufferCap' = Some (Cap_frame_cap (cap_frame_cap_lift bufferCap')); cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift bufferCap') < 4; v0a + (rv' && mask (pageBitsForSize v2)) \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> v0a + (rv' && mask (pageBitsForSize v2)) = generic_frame_cap_get_capFBasePtr_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))) + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (Some (Cap_frame_cap (cap_frame_cap_lift bufferCap'))))) - 1)
 2. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf4150 rv' bufferCap' d v0a v1 v2 v3) (?Rf4150 rv' bufferCap' d v0a v1 v2 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 2. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf4150 rv' bufferCap' d v0a v1 v2 v3 s)) s
 3. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf4150 rv' bufferCap' d v0a v1 v2 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> True)) s
 2. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> \<lbrace>((=) \<circ> option_to_ptr) Nothing NULL\<rbrace> \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 6. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 8. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v2 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 v2 v3)) bufferCap'; v2 \<noteq> Wellformed_C.ARMSmallPage; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> \<lbrace>((=) \<circ> option_to_ptr) Nothing NULL\<rbrace> \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?Q'2924 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'4670 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?R'4670 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'4670 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?R'4670 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'4677 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (SKIP;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?R'4677 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'4677 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?R'4677 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?G'4689 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'4689 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q2935 isReceivera thread bufferPtr rv' rv'a a b)) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P4929 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?P'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> ?P'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> ?P4929 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> ?P4929 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?P4929 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'4932 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL);;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> ?R'4932 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> ?P4929 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> ?P4929 isReceivera thread bufferPtr rv' rv'a a b) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (11 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4935 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL) {},UNIV
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long \<sigma>. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' s)}
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> ?R'4935 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 6. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 8. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long \<sigma>. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' s)}
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?Q'4919 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'4967 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (SKIP;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?R'4967 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) = Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'4967 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' bufferCap bufferCap' (cap_get_tag bufferCap') (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> ?R'4967 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned ret__unsigned_long vm_rights. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); capVPSize (capCap bufferCap) = Wellformed_C.ARMSmallPage; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'); \<not> isDeviceCap bufferCap; vm_rights = generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?G'4990 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' bufferCap bufferCap' (cap_get_tag bufferCap') (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')) vm_rights) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>va. va = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. va) s \<in> ?G'4990 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3))) (?G'4990 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap' (cap_get_tag bufferCap') (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')) (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap'))) [SKIP] (if v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly then do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing) (Cond (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>va. va = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. va) s \<in> ?G'4990 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v va} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> ?Q4928 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> ?Q4928 isReceivera thread bufferPtr rv' rv'a a b))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (13 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>bufferCap' d v0a v1 v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>bufferCap' d v0a v1 v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; (s, s') \<in> rf_sr; (v3 \<noteq> None \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3)) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None) \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')) = v1 \<and> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) = Wellformed_C.ARMSmallPage \<and> generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') = v0a \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4 \<and> generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4 \<and> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')) = False\<rbrakk> \<Longrightarrow> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap'))) Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) = Wellformed_C.ARMSmallPage; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))\<rbrakk> \<Longrightarrow> (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')) = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap')) = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMNoAccess then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) = Wellformed_C.ARMSmallPage; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))\<rbrakk> \<Longrightarrow> ((if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMNoAccess then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMNoAccess then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) = vmrights.VMReadOnly) = (s' \<in> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 0 then vmrights.VMNoAccess else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) = Wellformed_C.ARMSmallPage; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap'))\<rbrakk> \<Longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 2 \<longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 1 \<longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 0 \<longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) = Wellformed_C.ARMSmallPage; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') < 4; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 2; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 1; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 0\<rbrakk> \<Longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>bufferCap' d v3 s s'. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMKernelOnly then vmrights.VMKernelOnly else if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then vmrights.VMReadOnly else vmrights.VMReadWrite) Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; (s, s') \<in> rf_sr; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift bufferCap') = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift bufferCap') = 0) = (v3 = None); gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) = Wellformed_C.ARMSmallPage; generic_frame_cap_get_capFSize_CL (cap_lift bufferCap') < 4; \<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap')); generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 2; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 1; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<noteq> 0; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 0 \<or> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 1 \<or> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 2 \<or> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3\<rbrakk> \<Longrightarrow> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = 3
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 3. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 5. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 7. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 8. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 9. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 10. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') \<le> 3\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' d v0a v1 v3) (?Rt5214 rv' bufferCap' d v0a v1 v3) [SKIP] (do ptr <- return (v0a + PPtr (fromVPtr rv' && mask (pageBitsForSize Wellformed_C.ARMSmallPage)));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') \<le> 3\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?Rt5214 rv' bufferCap' False v0a v1 v3) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?Rt5214 rv' bufferCap' False v0a v1 v3) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?Rt5214 rv' bufferCap' False v0a v1 v3) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (lvar_nondet_init basePtr_' basePtr_'_update;;
(lvar_nondet_init pageBits_' pageBits_'_update;;
(\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))))))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Rt5214 rv' bufferCap' d v0a v1 v3 \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?G'5293 rv' bufferCap' False v0a v1 v3) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (lvar_nondet_init pageBits_' pageBits_'_update;;
(\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1)))))))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> ?G'5293 rv' bufferCap' d v0a v1 v3} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?G'5312 rv' bufferCap' False v0a v1 v3) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> ?G'5312 rv' bufferCap' d v0a v1 v3}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?G'5335 rv' bufferCap' False v0a v1 v3 basePtr) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
(\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat (pageBits_' s) - 1)))))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> ?G'5335 rv' bufferCap' d v0a v1 v3 v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?G'5462 rv' bufferCap' False v0a v1 v3 basePtr ret__unsigned_long) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(ret__unsigned_long);;
(\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat (pageBits_' s) - 1))))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'5462 rv' bufferCap' d v0a v1 v3 v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?G'5558 rv' bufferCap' False v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (\<acute>pageBits :== unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat (pageBits_' s) - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> ?G'5558 rv' bufferCap' d v0a v1 v3 v va vb}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?G'5628 rv' bufferCap' False v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (Guard ShiftError \<lbrace>unsigned_long_eret_2 < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat unsigned_long_eret_2 - 1)))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?G'5628 rv' bufferCap' d v0a v1 v3 v va vb}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H ret__unsigned_long))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?C'5672 rv' bufferCap' False v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr + (rv' && 2 ^ unat unsigned_long_eret_2 - 1))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?C'5672 rv' bufferCap' d v0a v1 v3 v va vb \<inter> \<lbrace>vb < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?C'5672 rv' bufferCap' False v0a v1 v3 (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) (word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')))))) [SKIP] (do y <- assert (v0a + (rv' && mask 12) \<noteq> 0);
return (Some (v0a + (rv' && mask 12)))
od) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) - 1))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?C'5672 rv' bufferCap' d v0a v1 v3 v va vb \<inter> \<lbrace>vb < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')))); v0a + (rv' && mask 12) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pt5214 rv' bufferCap' False v0a v1 v3) (?C'5672 rv' bufferCap' False v0a v1 v3 (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap')) (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')) (word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')))))) [SKIP] (return (Some (v0a + (rv' && mask 12)))) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) - 1))))
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> ?Pt5214 rv' bufferCap' d v0a v1 v3 s) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. va) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. vb) s \<in> ?C'5672 rv' bufferCap' d v0a v1 v3 v va vb \<inter> \<lbrace>vb < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. va) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. va) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')))); v0a + (rv' && mask 12) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) - 1))) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Some (v0a + (rv' && mask 12))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' s)}
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 basePtr ret__unsigned_long unsigned_long_eret_2 \<sigma>. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; basePtr = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap'); ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'); unsigned_long_eret_2 = word_of_nat (pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap')))); v0a + (rv' && mask 12) \<noteq> 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Some (v0a + (rv' && mask 12))) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_unsigned_long_' := PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) - 1)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> option_to_ptr rv = PTR(32 word) (generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) - 1))}
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 \<sigma> x. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift bufferCap') < 4; v0a + (rv' && mask 12) \<noteq> 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> v0a + (rv' && mask 12) = generic_frame_cap_get_capFBasePtr_CL (cap_lift bufferCap') + (rv' && 2 ^ pageBitsForSize (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift bufferCap'))) - 1)
 2. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 4. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 6. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 7. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 8. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 9. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Pf5214 rv' bufferCap' d v0a v1 v3) (?Rf5214 rv' bufferCap' d v0a v1 v3) [SKIP] (return Nothing) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL))
 2. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> ?Pf5214 rv' bufferCap' d v0a v1 v3 s)) s
 3. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> ?Rf5214 rv' bufferCap' d v0a v1 v3 \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 5. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 6. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 7. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 8. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 10. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly \<longrightarrow> True) and (\<lambda>s. \<not> (v1 = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> v1 = vmrights.VMReadOnly) \<longrightarrow> True)) s
 2. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> \<lbrace>((=) \<circ> option_to_ptr) Nothing NULL\<rbrace> \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 4. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 5. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 6. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 7. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 9. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 10. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>rv' bufferCap' d v0a v1 v3 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False v0a v1 Wellformed_C.ARMSmallPage v3)) bufferCap'; \<not> d; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. basePtr_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. pageBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> basePtr_'_update (\<lambda>_. v) s \<in> {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = word_of_nat (pageBitsForSize (gen_framesize_to_H (pagesize_' (pagesize_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pageBits_'_update (\<lambda>_. va) s \<in> UNIV \<inter> \<lbrace>va < 0x20\<rbrace>}}} \<inter> {s. pagesize_' (pagesize_'_update (\<lambda>_. v) s) && mask 2 = pagesize_' (pagesize_'_update (\<lambda>_. v) s)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {}) \<union> \<lbrace>((=) \<circ> option_to_ptr) Nothing NULL\<rbrace> \<inter> - (if generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly then UNIV else {})
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (9 subgoals):
 1. \<And>bufferCap' d. \<lbrakk>\<not> d; cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> \<not> isReceiver \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly\<rbrakk> \<Longrightarrow> (cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> (generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly)
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 5. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 6. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 8. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 9. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap')) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>} \<inter> {s. \<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. isDeviceCap bufferCap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>} \<inter> {s. \<not> isDeviceCap bufferCap \<longrightarrow> s \<in> {s. \<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. bufferCap') s))) \<longrightarrow> vm_rights_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>})
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'2897 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap bufferCap' (cap_get_tag bufferCap') \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 3. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> ?P'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (7 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap); (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> True))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>(capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v. v = cap_get_tag bufferCap' \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift bufferCap') \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 2. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 4. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 7. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (7 subgoals):
 1. \<And>bufferCap bufferCap' s. \<lbrakk>ccap_relation bufferCap bufferCap'; isArchObjectCap bufferCap; isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ((if (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') \<noteq> 0) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') = 0) \<and> (cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (capVPSize (capCap bufferCap) = Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') \<noteq> 0) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') = 0) \<and> (cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) then UNIV else {}) \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 2. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 4. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 7. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (7 subgoals):
 1. \<And>bufferCap bufferCap' s. \<lbrakk>ccap_relation bufferCap bufferCap'; isArchObjectCap bufferCap; isPageCap (capCap bufferCap)\<rbrakk> \<Longrightarrow> (if (capVPSize (capCap bufferCap) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') \<noteq> 0) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') = 0) \<and> (cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (capVPSize (capCap bufferCap) = Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') \<noteq> 0) \<and> (\<not> isDeviceCap bufferCap \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift bufferCap') = 0) \<and> (cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag bufferCap' = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) then UNIV else {}) \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, sa\<lparr>ret__int_' := if cap_get_tag bufferCap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr>) \<in> rf_sr}
 2. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 3. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 4. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 7. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' rv'a bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' rv'a bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap a \<Rightarrow> case a of arch_capability.PageCap bool baseptr rights sz x \<Rightarrow> case bool of True \<Rightarrow> return Nothing | False \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 3. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' () bufferCap) (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 3. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' () bufferCap) (?Q'5751 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) (?Q'5751 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ?Q2910 isReceivera thread bufferPtr rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' () bufferCap) (?R'5756 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) (?R'5756 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ?Q2910 isReceivera thread bufferPtr rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' () bufferCap) (?R'5756 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(bufferCap');;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) (?R'5756 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ?Q2910 isReceivera thread bufferPtr rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' () bufferCap) (?G'5767 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI)))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'5767 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ?Q2910 isReceivera thread bufferPtr rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' () bufferCap) (?G'6113 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (IF (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?G'6113 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ?Q2910 isReceivera thread bufferPtr rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 isReceivera thread bufferPtr rv' () bufferCap) (?R'6425 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL);;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?R'6425 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ?Q2910 isReceivera thread bufferPtr rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<longrightarrow> \<not> isPageCap (capCap bufferCap); ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> ccorres ((=) \<circ> option_to_ptr) ret__ptr_to_unsigned_long_' (?Q2910 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' () bufferCap) (?R'6425 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv' rv' bufferCap bufferCap' (cap_get_tag bufferCap') (cap_get_tag bufferCap')) [SKIP] (case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL);;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))))
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?R'6425 isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned v \<inter> \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); ?Q2910 isReceivera thread bufferPtr rv' () bufferCap s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> ?Q2910 isReceivera thread bufferPtr rv' rv'a a b)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<longrightarrow> \<not> isPageCap (capCap bufferCap); ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL);;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(bufferCap');;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI;;
(\<acute>vm_rights :== CALL generic_frame_cap_get_capFVMRights_'proc(bufferCap');;
IF \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadWrite \<or> from_bool isReceiver = 0 \<and> \<acute>vm_rights = SCAST(32 signed \<rightarrow> 32) Kernel_C.VMReadOnly THEN
  lvar_nondet_init basePtr_' basePtr_'_update;;
lvar_nondet_init pageBits_' pageBits_'_update;;
\<acute>basePtr :== CALL generic_frame_cap_get_capFBasePtr_'proc(bufferCap');;
\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(bufferCap');;
\<acute>unsigned_long_eret_2 :== CALL pageBitsForSize_'proc(\<acute>ret__unsigned_long);;
\<acute>pageBits :== \<acute>unsigned_long_eret_2;;
Guard ShiftError \<lbrace>\<acute>pageBits < 0x20\<rbrace> (return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. PTR(32 word) (basePtr_' s + (rv' && 2 ^ unat (pageBits_' s) - 1))))
ELSE
  return_C ret__ptr_to_unsigned_long_'_update (\<lambda>s. NULL)
FI))) {},{s. \<exists>(rv, \<sigma>')\<in>fst ((case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((=) \<circ> option_to_ptr) rv (ret__ptr_to_unsigned_long_' s)}
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> True)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (8 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigneda = cap_get_tag bufferCap'; isArchObjectCap bufferCap \<longrightarrow> \<not> isPageCap (capCap bufferCap); ret__unsigned = cap_get_tag bufferCap'\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((case bufferCap of capability.ArchObjectCap (arch_capability.PageCap True baseptr rights sz xa) \<Rightarrow> return Nothing | capability.ArchObjectCap (arch_capability.PageCap False baseptr rights sz xa) \<Rightarrow> do pBits <- return (pageBitsForSize sz);
if rights = vmrights.VMReadWrite \<or> \<not> isReceiver \<and> rights = vmrights.VMReadOnly then do ptr <- return (baseptr + PPtr (fromVPtr bufferPtr && mask pBits));
haskell_assert (ptr \<noteq> 0) [];
return $ Just ptr
od else return Nothing
od | capability.ArchObjectCap _ \<Rightarrow> return None | _ \<Rightarrow> return None) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_unsigned_long_' := NULL, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> option_to_ptr rv = NULL}
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 4. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> True)\<rbrace>
 5. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 7. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 8. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (7 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) ({s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap') s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>(if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 2. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2897 isReceivera thread bufferPtr rv' () bufferCap bufferCap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 3. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> True)\<rbrace>
 4. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> ?Q'2897 isReceivera thread bufferPtr rv' rv'a rv (bufferCap_' s) v}}
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 6. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 7. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>(\<forall>v. v = cap_get_tag bufferCap' \<longrightarrow> True \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) {s'. (s, s') \<in> rf_sr}
 2. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> True)\<rbrace>
 3. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> \<lbrace>(\<forall>v. v = cap_get_tag \<^bsup>s\<^esup>bufferCap \<longrightarrow> True \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}}
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' bufferCap bufferCap' ret__unsigned s. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation bufferCap bufferCap'; ret__unsigned = cap_get_tag bufferCap'; \<not> (isArchObjectCap bufferCap \<and> isPageCap (capCap bufferCap)); True\<rbrakk> \<Longrightarrow> \<lbrace>(\<forall>v. v = cap_get_tag bufferCap' \<longrightarrow> True \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, sa\<lparr>ret__int_' := if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr>) \<in> rf_sr}
 2. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> True)\<rbrace>
 3. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> \<lbrace>(\<forall>v. v = cap_get_tag \<^bsup>s\<^esup>bufferCap \<longrightarrow> True \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}}
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. (isArchObjectCap a \<and> isPageCap (capCap a) \<longrightarrow> (capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True)) \<and> (\<not> capVPSize (capCap a) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap a \<longrightarrow> True) \<and> (\<not> isDeviceCap a \<longrightarrow> True))) \<and> (\<not> (isArchObjectCap a \<and> isPageCap (capCap a)) \<longrightarrow> True)\<rbrace>
 2. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> \<lbrace>(\<forall>v. v = cap_get_tag \<^bsup>s\<^esup>bufferCap \<longrightarrow> True \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}}
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>rv'. \<lbrace>?R2338 (from_bool isReceiver) (tcb_ptr_to_ctcb_ptr t) rv'\<rbrace> getSlotCap (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> \<lbrace>(\<forall>v. v = cap_get_tag \<^bsup>s\<^esup>bufferCap \<longrightarrow> True \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}}
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and ?R2338 isReceivera thread a and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>isReceivera thread bufferPtr rv' rv'a s rv. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; bufferPtr = rv'; ccap_relation rv (bufferCap_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. bufferCap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> sa \<in> \<lbrace>(capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>va. va = v \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0) \<and> (\<not> capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> (isDeviceCap rv \<longrightarrow> True \<and> True \<and> v \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> (\<forall>v. v = generic_frame_cap_get_capFVMRights_CL (cap_lift \<^bsup>s\<^esup>bufferCap) \<longrightarrow> True) \<and> \<not> v \<noteq> 0)) \<and> (v = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> v = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<and> \<not> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0)\<rbrace>} \<inter> {sa. \<not> (isArchObjectCap rv \<and> isPageCap (capCap rv)) \<longrightarrow> sa \<in> \<lbrace>(\<forall>v. v = cap_get_tag \<^bsup>s\<^esup>bufferCap \<longrightarrow> True \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0) \<and> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0\<rbrace>}}
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> (capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (capVPSize (capCap rv) = Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)) \<and> ((isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> isArchObjectCap rv \<and> isPageCap (capCap rv) \<longrightarrow> (capVPSize (capCap rv) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (capVPSize (capCap rv) = Wellformed_C.ARMSmallPage \<longrightarrow> (isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> isDeviceCap rv \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)
 2. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s d v0a v1 v2 v3. ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0a v1 v2 v3)) (bufferCap_' s) \<Longrightarrow> (v2 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (v2 = Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)
 2. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0a v1 v2 v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = d\<rbrakk> \<Longrightarrow> (v2 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (v2 = Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)
 2. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0a v1 v2 v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = d; (v3 \<noteq> None \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3)) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None) \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s))) = v1 \<and> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) = v2 \<and> generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s)) = v0a \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4 \<and> generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4 \<and> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) = d\<rbrakk> \<Longrightarrow> (v2 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (v2 = Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)
 2. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s d v0a v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0a v1 v2 v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = d; (v3 \<noteq> None \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3)) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None) \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s))) = v1 \<and> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) = v2 \<and> generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s)) = v0a \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4 \<and> generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4 \<and> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) = d; cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> (v2 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (v2 = Wellformed_C.ARMSmallPage \<longrightarrow> (d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) \<and> (\<not> d \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)
 2. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)))) (generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s))) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)))) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)))) v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))); cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4; generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4\<rbrakk> \<Longrightarrow> (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (\<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) = Wellformed_C.ARMSmallPage \<longrightarrow> (\<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)
 2. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>s v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)))) (generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s))) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)))) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)))) v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))); cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4; generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4; gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>s v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)))) (generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s))) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)))) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)))) v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))); cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4; generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4\<rbrakk> \<Longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) = Wellformed_C.ARMSmallPage \<longrightarrow> (\<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)))) (generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s))) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)))) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)))) v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))); cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4; generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4\<rbrakk> \<Longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) = Wellformed_C.ARMSmallPage \<longrightarrow> (\<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (6 subgoals):
 1. \<And>s v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)))) (generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s))) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)))) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)))) v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))); (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4; generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4; cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) = Wellformed_C.ARMSmallPage \<longrightarrow> (\<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>s v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)))) (generic_frame_cap_get_capFBasePtr_CL (cap_lift (bufferCap_' s))) (vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)))) (gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)))) v3)) (bufferCap_' s); (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) \<noteq> 0) = to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))); (\<exists>a b. v3 = Some (a, b)) \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift (bufferCap_' s)) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = fst (the v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift (bufferCap_' s)) = 0) = (v3 = None); generic_frame_cap_get_capFVMRights_CL (cap_lift (bufferCap_' s)) < 4; generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s)) < 4; cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift (bufferCap_' s))) = Wellformed_C.ARMSmallPage \<longrightarrow> (\<not> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s))) \<longrightarrow> generic_frame_cap_get_capFIsDevice_CL (cap_lift (bufferCap_' s)) = 0) \<and> (cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 5. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 6. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>s rv. ccap_relation rv (bufferCap_' s) \<Longrightarrow> (isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>s rv. \<lbrakk>ccap_relation rv (bufferCap_' s); \<not> ((isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv)) \<longrightarrow> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag (bufferCap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap)\<rbrakk> \<Longrightarrow> False
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (4 subgoals):
 1. \<And>s rv. \<lbrakk>ccap_relation rv (bufferCap_' s); isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv); cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<or> cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> False
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 4. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (5 subgoals):
 1. \<And>s rv. \<lbrakk>ccap_relation rv (bufferCap_' s); isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv); cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> False
 2. \<And>s rv. \<lbrakk>ccap_relation rv (bufferCap_' s); isArchObjectCap rv \<longrightarrow> \<not> isPageCap (capCap rv); cap_get_tag (bufferCap_' s) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> False
 3. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 4. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 5. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (3 subgoals):
 1. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<lbrace>?R1634 isReceivera thread\<rbrace> threadGet tcbIPCBuffer t \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) b\<rbrace>
 2. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 3. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and ?R1634 isReceivera thread) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (2 subgoals):
 1. \<And>isReceivera thread. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1634 isReceivera thread\<^esub> (?R'1634 isReceivera thread) Guard C_Guard {s. s \<Turnstile>\<^sub>c thread} (\<acute>w_bufferPtr :== h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) &(thread\<rightarrow>[''tcbIPCBuffer_C'']))) {s. \<forall>bufferPtr. bufferPtr = w_bufferPtr_' s \<longrightarrow> s \<in> {s. s \<in> \<lbrace>cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot)\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace> \<inter> \<lbrace>SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries\<rbrace> \<inter> \<lbrace>0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries\<rbrace>}}
 2. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) a)) s \<and> s' \<in> UNIV \<inter> ?R'1634 isReceivera thread proof (prove)
goal (1 subgoal):
 1. \<And>isReceivera thread s s'. \<lbrakk>isReceivera = from_bool isReceiver; thread = tcb_ptr_to_ctcb_ptr t; (s, s') \<in> rf_sr; tcb_at' t s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' t and (\<lambda>a. cte_wp_at' (\<lambda>_. True) (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread) and tcb_at' (ctcb_ptr_to_tcb_ptr thread)) a)) s \<and> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c thread \<longrightarrow> cte_Ptr ((ptr_val thread && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) tcbBuffer * 0x10) = cte_Ptr (t + 2 ^ cte_level_bits * tcbIPCBufferSlot) \<and> 0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries \<and> SCAST(32 signed \<rightarrow> 32) tcbBuffer < UCAST(32 signed \<rightarrow> 32) tcbCNodeEntries \<and> 0 \<le> sint tcbBuffer \<and> (case False of True \<Rightarrow> sint tcbBuffer + 1 | False \<Rightarrow> sint tcbBuffer) \<le> uint tcbCNodeEntries} proof (prove)
goal:
No subgoals!