theory Tcb_C

lemma checkValidIPCBuffer_ccorres:
  "ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs') (UNIV \<inter> {s. vptr_' s = vptr} \<inter> {s. ccap_relation cp (cap_' s)}) []
       (checkValidIPCBuffer vptr cp)
       (Call checkValidIPCBuffer_'proc)" apply (simp add:checkValidIPCBuffer_def ARM_H.checkValidIPCBuffer_def) apply (cases "isArchPageCap cp \<and> \<not> isDeviceCap cp") apply (simp only: isCap_simps isDeviceCap.simps, safe)[1] apply (cinit lift: vptr_' cap_') apply (simp add: ARM_H.checkValidIPCBuffer_def  if_1_0_0 del: Collect_const) apply csymbr apply csymbr apply (clarsimp simp : if_1_0_0) apply (rule ccorres_symb_exec_r) apply simp apply (rule_tac xf'=ret__int_' in ccorres_abstract, ceqv) apply (rename_tac cond_is_frame) apply (rule ccorres_cond_false_seq) apply simp apply csymbr apply (rule ccorres_cond_false_seq) apply clarsimp apply (simp only:Cond_if_mem) apply (rule ccorres_Cond_rhs_Seq) apply (clarsimp simp add: msgAlignBits_def mask_def whenE_def) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def exception_defs
                              syscall_error_rel_def syscall_error_to_H_cases) apply (simp add: whenE_def msgAlignBits_def mask_def) apply (rule ccorres_return_CE, simp+)[1] apply (clarsimp simp: cap_get_tag_isCap isCap_simps pageSize_def
                           isDevice_PageCap_ccap_relation Collect_const_mem if_1_0_0
                           word_sle_def) apply vcg apply (clarsimp simp: cap_get_tag_isCap isCap_simps pageSize_def
                           isDevice_PageCap_ccap_relation Collect_const_mem) apply (rule conseqPre, vcg) apply (clarsimp simp: cap_get_tag_isCap isCap_simps pageSize_def
                          isDevice_PageCap_ccap_relation Collect_const_mem if_1_0_0
                          word_sle_def) apply (clarsimp simp: cap_get_tag_isCap isCap_simps pageSize_def
                         isDevice_PageCap_ccap_relation Collect_const_mem) apply (clarsimp simp: Collect_const_mem if_1_0_0
                          word_sle_def) apply (cases "isArchPageCap cp") apply (simp only: isCap_simps isDeviceCap.simps, safe)[1] apply (cinit lift: vptr_' cap_') apply (simp add: ARM_H.checkValidIPCBuffer_def  if_1_0_0 del: Collect_const) apply csymbr apply csymbr apply (clarsimp simp : if_1_0_0) apply (rule ccorres_symb_exec_r) apply simp apply (rule_tac xf'=ret__int_' in ccorres_abstract, ceqv) apply (rename_tac cond_is_frame) apply (rule ccorres_cond_false_seq) apply simp apply csymbr apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def exception_defs
                             syscall_error_rel_def syscall_error_to_H_cases) apply (simp add: cap_get_tag_isCap isCap_simps pageSize_def) apply vcg apply (rule conseqPre, vcg) apply (case_tac cp) apply (clarsimp simp: syscall_error_rel_def syscall_error_to_H_cases isCap_simps
                           exception_defs throwError_def return_def if_1_0_0
                    split: capability.split arch_capability.split if_split_asm)+ apply (simp add: cap_get_tag_isCap isCap_simps pageSize_def Cond_if_mem) apply (frule ccap_relation_page_is_device) apply (auto simp add: isCap_simps isDeviceCap.simps pageSize_def
                  split: if_splits)[1] apply (cinit lift: vptr_' cap_') apply csymbr apply (simp add: ARM_H.checkValidIPCBuffer_def
                    cap_get_tag_isCap) apply csymbr apply (rule ccorres_cond_true_seq)+ apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (simp add: cap_get_tag_isCap) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (case_tac cp) apply (auto simp: syscall_error_rel_def syscall_error_to_H_cases isCap_simps
                         exception_defs throwError_def return_def if_1_0_0
                  split: capability.split arch_capability.split if_split_asm) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (UNIV \<inter> \<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (checkValidIPCBuffer vptr cp) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. isArchPageCap cp \<and> \<not> isDeviceCap cp \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
 2. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>d ref rghts sz data. \<lbrakk>\<not> isDeviceCap (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)); cp = capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) \<acute>cap\<rbrace>) [] (case capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data) of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
 2. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 d ref rghts sz data cap vptra) (?Q'1073 d ref rghts sz data cap vptra) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptra && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> ?Q'1073 d ref rghts sz data cap vptra
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?Q'1073 False ref rghts sz data cap vptr) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptr && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> ?Q'1073 d ref rghts sz data cap vptra
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra ret__unsigned. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?G'1091 False ref rghts sz data cap vptr ret__unsigned) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptr && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1091 d ref rghts sz data cap vptra v}
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra ret__unsigned. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?G'1228 False ref rghts sz data cap vptr ret__unsigned) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (IF (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptr && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?Q'1344 d ref rghts sz data cap) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP (?Q'1344 d ref rghts sz data cap)
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?Q'1344 False ref rghts sz data cap) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP (?Q'1344 d ref rghts sz data cap)
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap rv'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?G'1355 ref rghts sz data cap rv') [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (IF rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?G'1353 d ref rghts sz data cap s}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?G'1355 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?G'1353 False proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?G'1355 ref rghts sz data cap cond_is_frame) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (IF cond_is_frame \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?G'1353 d ref rghts sz data cap s}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?G'1355 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?G'1353 False proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?R'1611 ref rghts sz data cap cond_is_frame) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?R'1609 d ref rghts sz data cap s \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'1611 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'1609 False proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?R'1611 ref rghts sz data cap cond_is_frame) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?R'1609 d ref rghts sz data cap s \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'1611 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'1609 False proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?G'1631 ref rghts sz data cap cond_is_frame ret__unsigned_long) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> ?G'1632 d ref rghts sz data cap s v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?G'1632 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?G'1631 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?R'1802 ref rghts sz data cap cond_is_frame ret__unsigned_long) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> ?R'1800 d ref rghts sz data cap s v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'1802 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'1800 False proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?R'1802 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> ?R'1800 d ref rghts sz data cap s v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'1802 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'1800 False proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1073 False ref rghts sz data cap vptr) (?R'1802 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (IF vptr && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> ?R'1800 d ref rghts sz data cap s v \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; ?Q1073 False ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1073 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'1802 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'1800 False proof (prove)
goal (6 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1823 False ref rghts sz data cap vptr) (?S1826 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; \<not> vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1822 False ref rghts sz data cap vptr) (?T1824 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> {sa. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?S1829 d ref rghts sz data cap s v) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?T1828 d ref rghts sz data cap s v)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 4. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?Q1823 False ref rghts sz data cap vptr s) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 False ref rghts sz data cap vptr s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 5. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?Q1823 d ref rghts sz data cap vptra s) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 d ref rghts sz data cap vptra s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 6. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?S1829 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?S1826 ref rghts sz data cap (ret__int_' s)
?T1828 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?T1824 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (6 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1823 False ref rghts sz data cap vptr) (?S1826 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (throwError Fault_H.syscall_error.AlignmentError) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; \<not> vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1822 False ref rghts sz data cap vptr) (?T1824 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> {sa. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?S1829 d ref rghts sz data cap s v) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?T1828 d ref rghts sz data cap s v)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 4. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?Q1823 False ref rghts sz data cap vptr s) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 False ref rghts sz data cap vptr s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 5. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?Q1823 d ref rghts sz data cap vptra s) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 d ref rghts sz data cap vptra s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 6. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?S1829 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?S1826 ref rghts sz data cap (ret__int_' s)
?T1828 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?T1824 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (7 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1837 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>d ref rghts sz data cap cond_is_frame \<sigma>. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.syscall_error.AlignmentError \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; \<not> vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1822 False ref rghts sz data cap vptr) (?T1824 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> {sa. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> ?R'1838 d ref rghts sz data cap s v) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?T1828 d ref rghts sz data cap s v)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 5. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 False ref rghts sz data cap vptr s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 6. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 d ref rghts sz data cap vptra s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 7. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?R'1838 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?R'1837 ref rghts sz data cap (ret__int_' s)
?T1828 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?T1824 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (6 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame \<sigma>. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.syscall_error.AlignmentError \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; \<not> vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1822 False ref rghts sz data cap vptr) (?T1824 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> {sa. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?T1828 d ref rghts sz data cap s v)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 4. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 False ref rghts sz data cap vptr s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 5. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 d ref rghts sz data cap vptra s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 6. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?T1828 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?T1824 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (6 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame \<sigma>. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.syscall_error.AlignmentError \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; \<not> vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1822 False ref rghts sz data cap vptr) (?T1824 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> {sa. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?T1828 d ref rghts sz data cap s v)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 4. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 False ref rghts sz data cap vptr s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 5. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 d ref rghts sz data cap vptra s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 6. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?T1828 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?T1824 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; \<not> vptr && 0x1FF \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1822 False ref rghts sz data cap vptr) (?T1824 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (whenE (vptr && mask msgAlignBits \<noteq> 0) (throwError Fault_H.syscall_error.AlignmentError)) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> {sa. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?T1828 d ref rghts sz data cap s v)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 False ref rghts sz data cap vptr s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 d ref rghts sz data cap vptra s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?T1828 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?T1824 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptr && 0x1FF = 0\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R1822 False ref rghts sz data cap vptr) (?T1824 ref rghts sz data cap cond_is_frame (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap))) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> {sa. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> sa \<in> ?T1828 d ref rghts sz data cap s v)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 False ref rghts sz data cap vptr s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> ?R1822 d ref rghts sz data cap vptra s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 5. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?T1828 False \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?T1824 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (4 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (vptr && 0x1FF \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> s \<in> \<lbrace>id (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> dc () (K () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))\<rbrace>)} \<inter> - \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 2. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> True)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 3. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 4. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP \<lbrace>\<acute>ret__int = 0\<rbrace>
 2. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> True)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'1228 False ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 3. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'1228 d ref rghts sz data cap vptra v}}
 4. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; (vptr && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptr && 0x1FF \<noteq> 0 \<longrightarrow> True)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) = 0)) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> ret__int_' s = 0)} \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = v \<longrightarrow> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) = 0)) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> ret__int_' s = 0)}}}
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>sz = Wellformed_C.ARMSmallPage \<longrightarrow> \<acute>ret__int = 0\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = v \<longrightarrow> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) = 0)) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> ret__int_' s = 0)}}}
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap s. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<lbrace>sz = Wellformed_C.ARMSmallPage \<longrightarrow> \<acute>ret__int = 0\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = v \<longrightarrow> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) = 0)) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> ret__int_' s = 0)}}}
 3. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>\<not> d; cp = capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data); ccap_relation (capability.ArchObjectCap (arch_capability.PageCap False ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vptra && 0x1FF \<noteq> 0 \<longrightarrow> True) \<and> (\<not> vptra && 0x1FF \<noteq> 0 \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = v \<longrightarrow> (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) = 0)) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> ret__int_' s = 0)}}}
 2. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (1 subgoal):
 1. \<not> (isArchPageCap cp \<and> \<not> isDeviceCap cp) \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (1 subgoal):
 1. isArchPageCap cp \<longrightarrow> isDeviceCap cp \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
 2. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>d ref rghts sz data. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data); isDeviceCap (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) \<acute>cap\<rbrace>) [] (case capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data) of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
 2. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 d ref rghts sz data cap vptra) (?Q'2958 d ref rghts sz data cap vptra) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptra && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> ?Q'2958 d ref rghts sz data cap vptra
 3. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?Q'2958 True ref rghts sz data cap vptr) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptr && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> ?Q'2958 d ref rghts sz data cap vptra
 3. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra ret__unsigned. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?G'2976 True ref rghts sz data cap vptr ret__unsigned) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptr && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2976 d ref rghts sz data cap vptra v}
 3. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap vptra ret__unsigned. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?G'3113 True ref rghts sz data cap vptr ret__unsigned) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (IF (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptr && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 3. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 3. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?Q'3229 d ref rghts sz data cap) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP (?Q'3229 d ref rghts sz data cap)
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?Q'3229 True ref rghts sz data cap) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP (?Q'3229 d ref rghts sz data cap)
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap rv'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?G'3240 ref rghts sz data cap rv') [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (IF rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?G'3238 d ref rghts sz data cap s}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?G'3240 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?G'3238 True proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?G'3240 ref rghts sz data cap cond_is_frame) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (IF cond_is_frame \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?G'3238 d ref rghts sz data cap s}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?G'3240 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?G'3238 True proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?R'3496 ref rghts sz data cap cond_is_frame) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (SKIP;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error);;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?R'3494 d ref rghts sz data cap s \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'3496 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'3494 True proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?R'3496 ref rghts sz data cap cond_is_frame) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> ?R'3494 d ref rghts sz data cap s \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'3496 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'3494 True proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?G'3516 ref rghts sz data cap cond_is_frame ret__unsigned_long) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> ?G'3517 d ref rghts sz data cap s v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
?G'3517 True \<equiv>\<^sup>? \<lambda>ref rghts sz data cap s. ?G'3516 ref rghts sz data cap (ret__int_' s) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2958 True ref rghts sz data cap vptr) (?R'3687 ref rghts sz data cap cond_is_frame ret__unsigned_long) [SKIP] (throwError Fault_H.syscall_error.IllegalOperation) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> ?R'3685 d ref rghts sz data cap s v \<inter> \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ?Q2958 True ref rghts sz data cap vptr s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2958 d ref rghts sz data cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'3687 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'3685 True proof (prove)
goal (6 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3692 ref rghts sz data cap cond_is_frame ret__unsigned_long) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long \<sigma>. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.syscall_error.IllegalOperation \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {sa. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. sa \<in> UNIV \<inter> ?R'3691 d ref rghts sz data cap s v \<inter> \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 4. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 5. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> d \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 6. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc)
flex-flex pairs:
\<lambda>ref rghts sz data cap s. ?R'3692 ref rghts sz data cap (ret__int_' s) \<equiv>\<^sup>? ?R'3691 True proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long \<sigma>. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.syscall_error.IllegalOperation \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> UNIV \<inter> \<lbrace>d\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> d \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (5 subgoals):
 1. \<And>d ref rghts sz data cap cond_is_frame ret__unsigned_long \<sigma>. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; ret__unsigned_long = generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.syscall_error.IllegalOperation \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> UNIV \<inter> \<lbrace>d\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 3. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 4. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> d \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 5. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFIsDevice_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> UNIV \<inter> \<lbrace>d\<rbrace> \<inter> \<lbrace>v \<noteq> 0\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} \<inter> - \<lbrace>\<^bsup>s\<^esup>ret__int \<noteq> 0\<rbrace>}
 2. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 3. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> d \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 4. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (4 subgoals):
 1. \<And>d ref rghts sz data cap. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap)) Cond (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s. s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {})}
 2. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3113 True ref rghts sz data cap vptr (cap_get_tag cap) \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 3. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> d \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> ?G'3113 d ref rghts sz data cap vptra v}}
 4. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> d \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = v \<longrightarrow> s\<lparr>ret__unsigned_' := v, ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := v, ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))}}}
 3. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (3 subgoals):
 1. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 2. \<And>d ref rghts sz data cap vptra s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> d \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = v \<longrightarrow> s\<lparr>ret__unsigned_' := v, ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := v, ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))}}}
 3. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (14 subgoals):
 1. \<And>d ref rghts sz data cap s x1. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 2. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.NullCap\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 3. \<And>d ref rghts sz data cap s x31 x32 x33 x34. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 4. \<And>d ref rghts sz data cap s x4. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 5. \<And>d ref rghts sz data cap s x51 x52 x53 x54 x55 x56. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 6. \<And>d ref rghts sz data cap s. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.DomainCap\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 7. \<And>d ref rghts sz data cap s x71 x72 x73. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 8. \<And>d ref rghts sz data cap s x8. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 9. \<And>d ref rghts sz data cap s x91 x92 x93. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
 10. \<And>d ref rghts sz data cap s x101 x102 x103 x104. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; True; cp = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> {s. (s \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 then UNIV else {}))) \<and> (s \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s\<lparr>ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s \<notin> (if ret__int_' s \<noteq> 0 then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (sa \<in> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr>) \<in> rf_sr)) \<and> (sa \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}) \<longrightarrow> (s, sa) \<in> rf_sr)}
A total of 14 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>d ref rghts sz data cap s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; (s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> (s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag cap) \<longrightarrow> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then UNIV else {})) \<and> (s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0\<rparr> \<notin> (if cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then UNIV else {}))
 2. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>d ref rghts sz data cap s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; (s, s') \<in> rf_sr; invs' s\<rbrakk> \<Longrightarrow> (s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz \<noteq> Wellformed_C.ARMSmallPage then 1 else 0\<rparr> \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag cap) \<longrightarrow> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz = Wellformed_C.ARMSmallPage then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz = Wellformed_C.ARMSmallPage then 1 else 0\<rparr> \<notin> (if sz = Wellformed_C.ARMSmallPage then UNIV else {})) \<and> (s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz \<noteq> Wellformed_C.ARMSmallPage then 1 else 0\<rparr> \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz \<noteq> Wellformed_C.ARMSmallPage then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}))
 2. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>d ref rghts sz data cap s s'. \<lbrakk>cp = capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data); d; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap True ref rghts sz data)) cap; (s, s') \<in> rf_sr; invs' s; (generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0) = True\<rbrakk> \<Longrightarrow> (s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz \<noteq> Wellformed_C.ARMSmallPage then 1 else 0\<rparr> \<in> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag cap) \<longrightarrow> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz = Wellformed_C.ARMSmallPage then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}) \<and> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz = Wellformed_C.ARMSmallPage then 1 else 0\<rparr> \<notin> (if sz = Wellformed_C.ARMSmallPage then UNIV else {})) \<and> (s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz \<noteq> Wellformed_C.ARMSmallPage then 1 else 0\<rparr> \<notin> (if sz \<noteq> Wellformed_C.ARMSmallPage then UNIV else {}) \<longrightarrow> s'\<lparr>ret__unsigned_' := cap_get_tag cap, ret__int_' := if sz \<noteq> Wellformed_C.ARMSmallPage then 1 else 0, ret__unsigned_long_' := generic_frame_cap_get_capFIsDevice_CL (cap_lift cap)\<rparr> \<in> (if generic_frame_cap_get_capFIsDevice_CL (cap_lift cap) \<noteq> 0 then UNIV else {}))
 2. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isArchPageCap cp \<longrightarrow> isDeviceCap cp; \<not> isArchPageCap cp\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') invs' (\<lbrace>\<acute>vptr = vptr\<rbrace> \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace>) [] (case cp of capability.ArchObjectCap (arch_capability.PageCap True x xa xb xc) \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | capability.ArchObjectCap (arch_capability.PageCap False x xa xb xc) \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | capability.ArchObjectCap _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation) (Call checkValidIPCBuffer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptra) (?Q'4798 cap vptra) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptra && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> ?Q'4798 cap vptra proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptra) (?G'4807 cap vptra ret__unsigned) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vptra && 0x1FF \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4807 cap vptra v} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptr) (?G'4807 cap vptr (cap_get_tag cap)) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__int :== 1;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4807 cap vptra v} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptr) (?G'4940 cap vptr (cap_get_tag cap)) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (IF 1 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'4940 cap vptra v}} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptr) (?R'5052 cap vptr (cap_get_tag cap)) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?R'5052 cap vptra v \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptr) (?R'5052 cap vptr (cap_get_tag cap)) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?R'5052 cap vptra v \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigneda ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptr) (?G'5071 cap vptr (cap_get_tag cap) ret__unsigned) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (\<acute>ret__int :== (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'5071 cap vptra v va} \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigneda ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptr) (?G'5317 cap vptr (cap_get_tag cap) ret__unsigned) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (IF (if ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?G'5317 cap vptra v va}} \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigneda ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4798 cap vptr) (?G'5317 cap vptr (cap_get_tag cap) (cap_get_tag cap)) [SKIP] (THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsDevice_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if vptr && 0x1FF \<noteq> 0 then UNIV else {}) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_AlignmentError) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q4798 cap vptra s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> ?G'5317 cap vptra v va}} \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (3 subgoals):
 1. \<And>cap vptra ret__unsigneda ret__unsigned. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5535 cap vptr (cap_get_tag cap) (cap_get_tag cap)) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s\<lparr>ret__int_' := if va \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> UNIV \<inter> ?R'5535 cap vptra v va}} \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (2 subgoals):
 1. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>cap vptra s s'. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s\<lparr>ret__int_' := if v \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>1 \<noteq> 0\<rbrace>}} proof (prove)
goal (13 subgoals):
 1. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x1. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.NullCap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 3. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x31 x32 x33 x34. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 4. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x4. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 5. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x51 x52 x53 x54 x55 x56. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 6. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma>. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.DomainCap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 7. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x71 x72 x73. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 8. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x8. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 9. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x91 x92 x93. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 10. \<And>cap vptra ret__unsigneda ret__unsigned \<sigma> x101 x102 x103 x104. \<lbrakk>\<not> isArchPageCap cp; ccap_relation cp cap; vptra = vptr; ret__unsigneda = cap_get_tag cap; ret__unsigned = cap_get_tag cap; cp = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((THE z. (\<exists>x1. cp = capability.ThreadCap x1) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.NullCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x31 x32 x33 x34. cp = capability.NotificationCap x31 x32 x33 x34) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x4. cp = capability.IRQHandlerCap x4) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x51 x52 x53 x54 x55 x56. cp = capability.EndpointCap x51 x52 x53 x54 x55 x56) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.DomainCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x71 x72 x73. cp = capability.Zombie x71 x72 x73) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x8. cp = capability.ArchObjectCap x8 \<and> z = (case x8 of arch_capability.PageCap True x xa xb xc \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | arch_capability.PageCap False x xa xb xc \<Rightarrow> doE whenE (vptr && mask msgAlignBits \<noteq> 0) $ throw Fault_H.syscall_error.AlignmentError;
returnOk ()
odE | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation)) \<or> (\<exists>x91 x92 x93. cp = capability.ReplyCap x91 x92 x93) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x101 x102 x103 x104. cp = capability.UntypedCap x101 x102 x103 x104) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> (\<exists>x111 x112 x113 x114. cp = capability.CNodeCap x111 x112 x113 x114) \<and> z = throwError Fault_H.syscall_error.IllegalOperation \<or> cp = capability.IRQControlCap \<and> z = throwError Fault_H.syscall_error.IllegalOperation) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
A total of 13 subgoals... proof (prove)
goal:
No subgoals!