theory CSpace_C

lemma maskCapRights_ccorres [corres]:
  "ccorres ccap_relation ret__struct_cap_C_'
           \<top>
           (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights\<rbrace>)
           []
           (return (RetypeDecls_H.maskCapRights R cap)) (Call maskCapRights_'proc)" apply (cinit' lift: cap_' cap_rights_') apply csymbr apply (simp add: maskCapRights_cap_cases cap_get_tag_isCap del: Collect_const) apply wpc apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply clarsimp apply (simp add: cap_get_tag_isCap isCap_simps return_def) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp simp: return_def) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply clarsimp apply (simp add: cap_get_tag_isCap isCap_simps return_def) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply clarsimp apply (unfold ccap_relation_def)[1] apply (simp add: cap_notification_cap_lift [THEN iffD1]) apply (clarsimp simp: cap_to_H_def) apply (simp add: map_option_case split: option.splits) apply (clarsimp simp add: cap_to_H_def Let_def
                               split: cap_CL.splits if_split_asm) apply (simp add: cap_notification_cap_lift_def) apply (simp add: ccap_rights_relation_def cap_rights_to_H_def
                             to_bool_ntfn_cap_bf
                             to_bool_mask_to_bool_bf to_bool_cap_rights_bf) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp simp: cap_get_tag_isCap isCap_simps return_def) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply clarsimp apply (simp add: cap_get_tag_isCap isCap_simps return_def) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply (rule imp_ignore) apply clarsimp apply (unfold ccap_relation_def)[1] apply (simp add: cap_endpoint_cap_lift [THEN iffD1]) apply (clarsimp simp: cap_to_H_def) apply (simp add: map_option_case split: option.splits) apply (clarsimp simp add: cap_to_H_def Let_def
                             split: cap_CL.splits if_split_asm) apply (simp add: cap_endpoint_cap_lift_def) apply (simp add: ccap_rights_relation_def cap_rights_to_H_def
                           to_bool_ep_cap_bf
                           to_bool_mask_to_bool_bf to_bool_cap_rights_bf) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp simp: return_def) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp simp: cap_get_tag_isCap isCap_simps return_def) apply (simp add: Collect_const_mem) apply (subst bind_return [symmetric]) apply (rule ccorres_split_throws) apply ctac apply (rule_tac P=\<top> and P'="\<lbrace>\<acute>ret__struct_cap_C = ret__struct_cap_C\<rbrace>" in ccorres_inst) apply (rule ccorres_from_vcg_throws) apply (clarsimp simp: return_def) apply (rule conseqPre) apply vcg apply clarsimp apply wp apply vcg apply vcg apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply ccorres_rewrite apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (simp add: cap_get_tag_isCap isCap_simps return_def) apply clarsimp apply (unfold ccap_relation_def)[1] apply (simp add: cap_reply_cap_lift [THEN iffD1]) apply (clarsimp simp: cap_to_H_def) apply (simp add: map_option_case split: option.splits) apply (clarsimp simp add: cap_to_H_def Let_def
                      split: cap_CL.splits if_split_asm) apply (simp add: cap_reply_cap_lift_def) apply (simp add: ccap_rights_relation_def cap_rights_to_H_def
                       to_bool_reply_cap_bf
                       to_bool_mask_to_bool_bf[simplified] to_bool_cap_rights_bf) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp simp: return_def) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply clarsimp apply (simp add: cap_get_tag_isCap isCap_simps return_def) apply (simp add: Collect_const_mem) apply csymbr apply (simp add: cap_get_tag_isCap isCap_simps del: Collect_const) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp simp: return_def) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights\<rbrace>) [] (return (global.maskCapRights R cap)) (Call maskCapRights_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2381 cap_rights capa) (?Q'2381 cap_rights capa) [SKIP] (return (global.maskCapRights R cap)) (\<acute>ret__unsigned_long :== CALL isArchCap_'proc(capa);;
(IF 0 < \<acute>ret__unsigned_long THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)))
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2381 cap_rights capa s \<and> s' \<in> ?Q'2381 cap_rights capa proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag capa))\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2381 cap_rights capa) (?G'2390 cap_rights capa ret__unsigned_long) [SKIP] (return (global.maskCapRights R cap)) (IF 0 < ret__unsigned_long THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2381 cap_rights capa s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'2390 cap_rights capa v} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2381 cap_rights capa) (?G'2390 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap)) | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap)))) | capability.ArchObjectCap ac \<Rightarrow> return (Arch.maskCapRights R ac) | capability.ReplyCap x xa xb \<Rightarrow> return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap) | _ \<Rightarrow> return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2381 cap_rights capa s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'2390 cap_rights capa v} proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3350 cap_rights capa x1) (?R''3296 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x1) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3350 cap_rights capa x1) (?R''3296 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x1) [SKIP] (return (capability.ThreadCap x1)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3350 cap_rights capa x1) (?G'3378 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x1 ret__unsigned) [SKIP] (return (capability.ThreadCap x1)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3350 cap_rights capa x1) (?G'3378 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x1 (cap_get_tag capa)) [SKIP] (return (capability.ThreadCap x1)) (IF True THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3350 cap_rights capa x1) (?G'3378 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x1 (cap_get_tag capa)) [SKIP] (return (capability.ThreadCap x1)) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ThreadCap x1) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ThreadCap x1) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'3850 cap_rights capa ret__unsigned_long x1 ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ThreadCap x1) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'3850 cap_rights capa ret__unsigned_long x1 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x1 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ThreadCap x1; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ThreadCap x1) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa x1 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ThreadCap x1) capa; cap = capability.ThreadCap x1; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (return (capability.ThreadCap x1) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> ccap_relation rv capa
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?R''3294 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (return capability.NullCap) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?G'3875 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) ret__unsigned) [SKIP] (return capability.NullCap) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?G'3875 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (return capability.NullCap) (IF True THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3308 cap_rights capa) (?G'3875 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (return capability.NullCap) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.NullCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.NullCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'4347 cap_rights capa ret__unsigned_long ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.NullCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'4347 cap_rights capa ret__unsigned_long ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.NullCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NullCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return capability.NullCap \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x31 x32 x33 x34) [SKIP] (return (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead R) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite R) cap))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?R''3292 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x31 x32 x33 x34) [SKIP] (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?G'4365 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x31 x32 x33 x34 ret__unsigned) [SKIP] (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?G'4365 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x31 x32 x33 x34 (cap_get_tag capa)) [SKIP] (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R))) (IF False THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF True THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3343 cap_rights capa x31 x32 x33 x34) (?G'4365 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x31 x32 x33 x34 (cap_get_tag capa)) [SKIP] (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R))) (lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_')
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'4837 cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned \<sigma>) lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'4837 cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x31 x32 x33 x34 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v. cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> (\<forall>t. ret__unsigned_' t = capNtfnCanSend_CL (cap_notification_cap_lift capa) \<longrightarrow> (\<forall>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && mask 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> (\<forall>t. ret__unsigned_' t = capNtfnCanReceive_CL (cap_notification_cap_lift capa) \<longrightarrow> (\<forall>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights) \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && mask 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && mask 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := capNtfnCanReceive_CL (cap_notification_cap_lift capa), unsigned_eret_2_' := capAllowRead_CL (seL4_CapRights_lift cap_rights), new_cap_' := ret__struct_cap_C_' t, ret__struct_cap_C_' := ret__struct_cap_C_' t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' t))))))))}
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> ((\<exists>t. ret__unsigned_' t = capNtfnCanSend_CL (cap_notification_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> ((\<exists>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<and> ((\<exists>t. ret__unsigned_' t = capNtfnCanReceive_CL (cap_notification_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (\<exists>xa\<in>fst (return (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' t))))))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnCanSend_CL (cap_notification_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnCanReceive_CL (cap_notification_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnCanReceive_CL (cap_notification_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnCanReceive_CL (cap_notification_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnCanReceive_CL (cap_notification_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) (ret__struct_cap_C_' t)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x t. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.NotificationCap x31 x32 x33 x34) capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr; cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) (ret__struct_cap_C_' t)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x t. \<lbrakk>ccap_rights_relation R cap_rights; Some (capability.NotificationCap x31 x32 x33 x34) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr; cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> Some (capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R)) = map_option cap_to_H (cap_lift (ret__struct_cap_C_' t)) \<and> c_valid_cap (ret__struct_cap_C_' t)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x t. \<lbrakk>ccap_rights_relation R cap_rights; Some (capability.NotificationCap x31 x32 x33 x34) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr; cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> capability.NotificationCap x31 x32 (x33 \<and> capAllowWrite R) (x34 \<and> capAllowRead R) = cap_to_H (Cap_notification_cap (cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>))
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x t. \<lbrakk>ccap_rights_relation R cap_rights; cap = capability.NotificationCap x31 x32 x33 x34; (\<sigma>, x) \<in> rf_sr; cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; Some (capability.NotificationCap x31 x32 x33 x34) = map_option cap_to_H (cap_lift capa); c_valid_cap capa\<rbrakk> \<Longrightarrow> x31 = capNtfnPtr_CL (cap_notification_cap_lift capa) \<and> x32 = capNtfnBadge_CL (cap_notification_cap_lift capa) \<and> (x33 \<and> capAllowWrite R) = to_bool ((capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x34 \<and> capAllowRead R) = to_bool ((capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa x31 x32 x33 x34 \<sigma> x t x2. \<lbrakk>c_valid_cap capa; ccap_rights_relation R cap_rights; cap = cap_to_H x2; (\<sigma>, x) \<in> rf_sr; cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; cap_lift capa = Some x2; capability.NotificationCap x31 x32 x33 x34 = cap_to_H x2\<rbrakk> \<Longrightarrow> x31 = capNtfnPtr_CL (cap_notification_cap_lift capa) \<and> x32 = capNtfnBadge_CL (cap_notification_cap_lift capa) \<and> (x33 \<and> capAllowWrite R) = to_bool ((capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x34 \<and> capAllowRead R) = to_bool ((capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa \<sigma> x t x4. \<lbrakk>(\<sigma>, x) \<in> rf_sr; cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift capa\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; cap_lift capa = Some (Cap_notification_cap x4); c_valid_cap capa; ccap_rights_relation R cap_rights; cap = capability.NotificationCap (capNtfnPtr_CL x4) (capNtfnBadge_CL x4) (to_bool (capNtfnCanSend_CL x4)) (to_bool (capNtfnCanReceive_CL x4))\<rbrakk> \<Longrightarrow> capNtfnPtr_CL x4 = capNtfnPtr_CL (cap_notification_cap_lift capa) \<and> capNtfnBadge_CL x4 = capNtfnBadge_CL (cap_notification_cap_lift capa) \<and> (to_bool (capNtfnCanSend_CL x4) \<and> capAllowWrite R) = to_bool ((capNtfnCanSend_CL (cap_notification_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capNtfnCanReceive_CL x4) \<and> capAllowRead R) = to_bool ((capNtfnCanReceive_CL (cap_notification_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa \<sigma> x t x4. \<lbrakk>(\<sigma>, x) \<in> rf_sr; (case cap_lift (ret__struct_cap_C_' t) of Some (Cap_notification_cap rec) \<Rightarrow> rec) = x4\<lparr>capNtfnCanSend_CL := (capNtfnCanSend_CL x4 && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capNtfnCanReceive_CL := (capNtfnCanReceive_CL x4 && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; cap_lift capa = Some (Cap_notification_cap x4); c_valid_cap capa; ccap_rights_relation R cap_rights; cap = capability.NotificationCap (capNtfnPtr_CL x4) (capNtfnBadge_CL x4) (to_bool (capNtfnCanSend_CL x4)) (to_bool (capNtfnCanReceive_CL x4))\<rbrakk> \<Longrightarrow> (to_bool (capNtfnCanSend_CL x4) \<and> capAllowWrite R) = to_bool ((capNtfnCanSend_CL x4 && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capNtfnCanReceive_CL x4) \<and> capAllowRead R) = to_bool ((capNtfnCanReceive_CL x4 && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x4) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> ?R3339 cap_rights capa x s) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> ?R''3290 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?R''3290 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x4) [SKIP] (return (capability.IRQHandlerCap x4)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> ?R3339 cap_rights capa x s) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> ?R''3290 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?G'5061 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x4 ret__unsigned) [SKIP] (return (capability.IRQHandlerCap x4)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> ?R3339 cap_rights capa x s) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'5061 cap_rights capa v x va}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3339 cap_rights capa x4) (?G'5061 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x4 (cap_get_tag capa)) [SKIP] (return (capability.IRQHandlerCap x4)) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> ?R3339 cap_rights capa x s) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'5061 cap_rights capa v x va}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.IRQHandlerCap x4) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.IRQHandlerCap x4) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (11 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'5533 cap_rights capa ret__unsigned_long x4 ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.IRQHandlerCap x4) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x4 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'5533 cap_rights capa ret__unsigned_long x4 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x4 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.IRQHandlerCap x4) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.IRQHandlerCap x4) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x51 x52 x53 x54 x55 x56) [SKIP] (return (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply R) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant R) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead R) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite R) cap))))) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?R''3288 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x51 x52 x53 x54 x55 x56) [SKIP] (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3288 cap_rights capa v x xa xb xc xd xe}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?G'5551 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x51 x52 x53 x54 x55 x56 ret__unsigned) [SKIP] (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'5551 cap_rights capa v x xa xb xc xd xe va}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3335 cap_rights capa x51 x52 x53 x54 x55 x56) (?G'5551 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x51 x52 x53 x54 x55 x56 (cap_get_tag capa)) [SKIP] (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R))) (lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_')
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> ?R3335 cap_rights capa x xa xb xc xd xe s) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'5551 cap_rights capa v x xa xb xc xd xe va}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'6023 cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned \<sigma>) lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'6023 cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x51 x52 x53 x54 x55 x56 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v. cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capCanSend_CL (cap_endpoint_cap_lift capa) \<longrightarrow> (\<forall>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && mask 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capCanReceive_CL (cap_endpoint_cap_lift capa) \<longrightarrow> (\<forall>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && mask 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && mask 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa) \<longrightarrow> (\<forall>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && mask 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && mask 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && mask 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa) \<longrightarrow> (\<forall>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && mask 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && mask 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && mask 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && mask 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := capCanGrantReply_CL (cap_endpoint_cap_lift capa), unsigned_eret_2_' := capAllowGrantReply_CL (seL4_CapRights_lift cap_rights), new_cap_' := ret__struct_cap_C_' t, ret__struct_cap_C_' := ret__struct_cap_C_' t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' t))))))))))))))}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ((\<exists>t. ret__unsigned_' t = capCanSend_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ((\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ((\<exists>t. ret__unsigned_' t = capCanReceive_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ((\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ((\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>xa\<in>fst (return (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' t))))))))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capCanSend_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanReceive_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowWrite_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanReceive_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanReceive_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capCanReceive_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowRead_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrant_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<exists>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCanGrantReply_CL (cap_endpoint_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' t))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x t ta tb tc. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr; cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' ta = capCanGrantReply_CL (cap_endpoint_cap_lift capa); ret__unsigned_' tb = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights); cap_endpoint_cap_lift (ret__struct_cap_C_' tc) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) (ret__struct_cap_C_' tc)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x t ta tb tc. \<lbrakk>ccap_rights_relation R cap_rights; Some (capability.EndpointCap x51 x52 x53 x54 x55 x56) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr; cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' ta = capCanGrantReply_CL (cap_endpoint_cap_lift capa); ret__unsigned_' tb = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights); cap_endpoint_cap_lift (ret__struct_cap_C_' tc) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> Some (capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R)) = map_option cap_to_H (cap_lift (ret__struct_cap_C_' tc)) \<and> c_valid_cap (ret__struct_cap_C_' tc)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x t ta tb tc. \<lbrakk>ccap_rights_relation R cap_rights; Some (capability.EndpointCap x51 x52 x53 x54 x55 x56) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr; cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' ta = capCanGrantReply_CL (cap_endpoint_cap_lift capa); ret__unsigned_' tb = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights); cap_endpoint_cap_lift (ret__struct_cap_C_' tc) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> capability.EndpointCap x51 x52 (x53 \<and> capAllowWrite R) (x54 \<and> capAllowRead R) (x55 \<and> capAllowGrant R) (x56 \<and> capAllowGrantReply R) = cap_to_H (Cap_endpoint_cap (cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x t ta tb tc. \<lbrakk>ccap_rights_relation R cap_rights; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; (\<sigma>, x) \<in> rf_sr; cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' ta = capCanGrantReply_CL (cap_endpoint_cap_lift capa); ret__unsigned_' tb = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights); cap_endpoint_cap_lift (ret__struct_cap_C_' tc) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; Some (capability.EndpointCap x51 x52 x53 x54 x55 x56) = map_option cap_to_H (cap_lift capa); c_valid_cap capa\<rbrakk> \<Longrightarrow> x51 = capEPPtr_CL (cap_endpoint_cap_lift capa) \<and> x52 = capEPBadge_CL (cap_endpoint_cap_lift capa) \<and> (x53 \<and> capAllowWrite R) = to_bool ((capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x54 \<and> capAllowRead R) = to_bool ((capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x55 \<and> capAllowGrant R) = to_bool ((capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x56 \<and> capAllowGrantReply R) = to_bool ((capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x51 x52 x53 x54 x55 x56 \<sigma> x t ta tb tc x2. \<lbrakk>c_valid_cap capa; ccap_rights_relation R cap_rights; cap = cap_to_H x2; (\<sigma>, x) \<in> rf_sr; cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' ta = capCanGrantReply_CL (cap_endpoint_cap_lift capa); ret__unsigned_' tb = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights); cap_endpoint_cap_lift (ret__struct_cap_C_' tc) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_lift capa = Some x2; capability.EndpointCap x51 x52 x53 x54 x55 x56 = cap_to_H x2\<rbrakk> \<Longrightarrow> x51 = capEPPtr_CL (cap_endpoint_cap_lift capa) \<and> x52 = capEPBadge_CL (cap_endpoint_cap_lift capa) \<and> (x53 \<and> capAllowWrite R) = to_bool ((capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x54 \<and> capAllowRead R) = to_bool ((capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x55 \<and> capAllowGrant R) = to_bool ((capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (x56 \<and> capAllowGrantReply R) = to_bool ((capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa \<sigma> x t ta tb tc x3. \<lbrakk>(\<sigma>, x) \<in> rf_sr; cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' ta = capCanGrantReply_CL (cap_endpoint_cap_lift capa); ret__unsigned_' tb = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights); cap_endpoint_cap_lift (ret__struct_cap_C_' tc) = cap_endpoint_cap_lift capa\<lparr>capCanSend_CL := (capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_lift capa = Some (Cap_endpoint_cap x3); c_valid_cap capa; ccap_rights_relation R cap_rights; cap = capability.EndpointCap (capEPPtr_CL x3) (capEPBadge_CL x3) (to_bool (capCanSend_CL x3)) (to_bool (capCanReceive_CL x3)) (to_bool (capCanGrant_CL x3)) (to_bool (capCanGrantReply_CL x3))\<rbrakk> \<Longrightarrow> capEPPtr_CL x3 = capEPPtr_CL (cap_endpoint_cap_lift capa) \<and> capEPBadge_CL x3 = capEPBadge_CL (cap_endpoint_cap_lift capa) \<and> (to_bool (capCanSend_CL x3) \<and> capAllowWrite R) = to_bool ((capCanSend_CL (cap_endpoint_cap_lift capa) && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capCanReceive_CL x3) \<and> capAllowRead R) = to_bool ((capCanReceive_CL (cap_endpoint_cap_lift capa) && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capCanGrant_CL x3) \<and> capAllowGrant R) = to_bool ((capCanGrant_CL (cap_endpoint_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capCanGrantReply_CL x3) \<and> capAllowGrantReply R) = to_bool ((capCanGrantReply_CL (cap_endpoint_cap_lift capa) && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa \<sigma> x t ta tb tc x3. \<lbrakk>(\<sigma>, x) \<in> rf_sr; (case cap_lift (ret__struct_cap_C_' t) of Some (Cap_endpoint_cap rec) \<Rightarrow> rec) = x3\<lparr>capCanSend_CL := (capCanSend_CL x3 && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL x3 && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL x3 && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' ta = capCanGrantReply_CL x3; ret__unsigned_' tb = capAllowGrantReply_CL (seL4_CapRights_lift cap_rights); (case cap_lift (ret__struct_cap_C_' tc) of Some (Cap_endpoint_cap rec) \<Rightarrow> rec) = x3\<lparr>capCanSend_CL := (capCanSend_CL x3 && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1, capCanReceive_CL := (capCanReceive_CL x3 && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrant_CL := (capCanGrant_CL x3 && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1, capCanGrantReply_CL := (capCanGrantReply_CL x3 && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; cap_lift capa = Some (Cap_endpoint_cap x3); c_valid_cap capa; ccap_rights_relation R cap_rights; cap = capability.EndpointCap (capEPPtr_CL x3) (capEPBadge_CL x3) (to_bool (capCanSend_CL x3)) (to_bool (capCanReceive_CL x3)) (to_bool (capCanGrant_CL x3)) (to_bool (capCanGrantReply_CL x3))\<rbrakk> \<Longrightarrow> (to_bool (capCanSend_CL x3) \<and> capAllowWrite R) = to_bool ((capCanSend_CL x3 && capAllowWrite_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capCanReceive_CL x3) \<and> capAllowRead R) = to_bool ((capCanReceive_CL x3 && capAllowRead_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capCanGrant_CL x3) \<and> capAllowGrant R) = to_bool ((capCanGrant_CL x3 && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1) \<and> (to_bool (capCanGrantReply_CL x3) \<and> capAllowGrantReply R) = to_bool ((capCanGrantReply_CL x3 && capAllowGrantReply_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?R''3286 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (return capability.DomainCap) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> ?R''3286 cap_rights capa v} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?G'6392 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) ret__unsigned) [SKIP] (return capability.DomainCap) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'6392 cap_rights capa v va}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?G'6392 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (return capability.DomainCap) (IF True THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'6392 cap_rights capa v va}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3304 cap_rights capa) (?G'6392 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (return capability.DomainCap) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> ?R3304 cap_rights capa s) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'6392 cap_rights capa v va}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.DomainCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.DomainCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'6864 cap_rights capa ret__unsigned_long ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.DomainCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'6864 cap_rights capa ret__unsigned_long ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.DomainCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.DomainCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return capability.DomainCap \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x71 x72 x73) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?R''3284 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x71 x72 x73) [SKIP] (return (capability.Zombie x71 x72 x73)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> ?R''3284 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?G'6882 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x71 x72 x73 ret__unsigned) [SKIP] (return (capability.Zombie x71 x72 x73)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'6882 cap_rights capa v x xa xb va}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3328 cap_rights capa x71 x72 x73) (?G'6882 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x71 x72 x73 (cap_get_tag capa)) [SKIP] (return (capability.Zombie x71 x72 x73)) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> ?R3328 cap_rights capa x xa xb s) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'6882 cap_rights capa v x xa xb va}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie x71 x72 x73) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie x71 x72 x73) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'7354 cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie x71 x72 x73) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'7354 cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x71 x72 x73 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.Zombie x71 x72 x73) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.Zombie x71 x72 x73; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.Zombie x71 x72 x73) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x8) [SKIP] (return (Arch.maskCapRights R x8)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3324 cap_rights capa x8) (?R''3282 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) x8) [SKIP] (return (Arch.maskCapRights R x8)) (\<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R3324 cap_rights capa x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R7363 cap_rights cap_rights capa capa x8 x8) (?R''7364 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) [SKIP] (return (Arch.maskCapRights R x8) >>= return) (\<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R7363 cap_rights cap_rights capa capa x x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?R''3282 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa x8. ?R''7364 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 \<equiv>\<^sup>? \<lambda>cap_rights capa. ?R''3282 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R7363 cap_rights cap_rights capa capa x8 x8) (?P'7368 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) [SKIP] (return (Arch.maskCapRights R x8) >>= return) (\<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ?R7363 cap_rights cap_rights capa capa x x s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> ?P'7370 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?P'7370 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?P'7368 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8 rv ret__struct_cap_C. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8; ccap_relation rv ret__struct_cap_C\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q7380 cap_rights capa ret__unsigned_long x8 rv) (?Q'7380 cap_rights capa ret__unsigned_long x8 rv ret__struct_cap_C) [SKIP] (return rv) (return_C ret__struct_cap_C_'_update (\<lambda>a. ret__struct_cap_C))
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<lbrace>?R7391 cap_rights cap_rights capa capa x8 x8\<rbrace> return (Arch.maskCapRights R x8) \<lbrace>?Q7380 cap_rights capa ret__unsigned_long x8\<rbrace>
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> ?Q'7380 cap_rights capa ret__unsigned_long x8 rv (ret__struct_cap_C_' s)}
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and ?R7391 cap_rights cap_rights capa capa x x) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8 rv ret__struct_cap_C. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8; ccap_relation rv ret__struct_cap_C\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) \<lbrace>\<acute>ret__struct_cap_C = ret__struct_cap_C\<rbrace> [SKIP] (return rv) (return_C ret__struct_cap_C_'_update (\<lambda>a. ret__struct_cap_C))
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<lbrace>?R7391 cap_rights cap_rights capa capa x8 x8\<rbrace> return (Arch.maskCapRights R x8) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> \<lbrace>\<acute>ret__struct_cap_C = \<^bsup>s\<^esup>ret__struct_cap_C\<rbrace>}
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and ?R7391 cap_rights cap_rights capa capa x x) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8 rv ret__struct_cap_C. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8; ccap_relation rv ret__struct_cap_C\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>\<acute>ret__struct_cap_C = ret__struct_cap_C\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>a. ret__struct_cap_C) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return rv \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<lbrace>?R7391 cap_rights cap_rights capa capa x8 x8\<rbrace> return (Arch.maskCapRights R x8) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> \<lbrace>\<acute>ret__struct_cap_C = \<^bsup>s\<^esup>ret__struct_cap_C\<rbrace>}
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and ?R7391 cap_rights cap_rights capa capa x x) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x8 rv ret__struct_cap_C \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; cap = capability.ArchObjectCap x8; ccap_relation rv ret__struct_cap_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. ret__struct_cap_C_' s = ret__struct_cap_C \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>a. ret__struct_cap_C) {},{s. (\<sigma>, s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<lbrace>?R7391 cap_rights cap_rights capa capa x8 x8\<rbrace> return (Arch.maskCapRights R x8) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> \<lbrace>\<acute>ret__struct_cap_C = \<^bsup>s\<^esup>ret__struct_cap_C\<rbrace>}
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and ?R7391 cap_rights cap_rights capa capa x x) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (10 subgoals):
 1. \<And>cap_rights capa x8 rv ret__struct_cap_C \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; cap = capability.ArchObjectCap x8; ccap_relation rv ret__struct_cap_C\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'7447 cap_rights capa x8 rv ret__struct_cap_C \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>a. ret__struct_cap_C) {},{s. (\<sigma>, s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa x8 rv ret__struct_cap_C \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; cap = capability.ArchObjectCap x8; ccap_relation rv ret__struct_cap_C\<rbrakk> \<Longrightarrow> {s. ret__struct_cap_C_' s = ret__struct_cap_C \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'7447 cap_rights capa x8 rv ret__struct_cap_C \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<lbrace>?R7391 cap_rights cap_rights capa capa x8 x8\<rbrace> return (Arch.maskCapRights R x8) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> \<lbrace>\<acute>ret__struct_cap_C = \<^bsup>s\<^esup>ret__struct_cap_C\<rbrace>}
 5. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 6. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 10. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and ?R7391 cap_rights cap_rights capa capa x x) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (9 subgoals):
 1. \<And>cap_rights capa x8 rv ret__struct_cap_C \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; cap = capability.ArchObjectCap x8; ccap_relation rv ret__struct_cap_C\<rbrakk> \<Longrightarrow> {s. ret__struct_cap_C_' s = ret__struct_cap_C \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<sigma>, s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv ret__struct_cap_C}
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<lbrace>?R7391 cap_rights cap_rights capa capa x8 x8\<rbrace> return (Arch.maskCapRights R x8) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> \<lbrace>\<acute>ret__struct_cap_C = \<^bsup>s\<^esup>ret__struct_cap_C\<rbrace>}
 4. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 5. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 9. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and ?R7391 cap_rights cap_rights capa capa x x) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (8 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<lbrace>?R7391 cap_rights cap_rights capa capa x8 x8\<rbrace> return (Arch.maskCapRights R x8) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> \<lbrace>\<acute>ret__struct_cap_C = \<^bsup>s\<^esup>ret__struct_cap_C\<rbrace>}
 3. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 4. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 8. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and ?R7391 cap_rights cap_rights capa capa x x) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa) {s. \<forall>rv. ccap_relation rv (ret__struct_cap_C_' s) \<longrightarrow> s \<in> \<lbrace>\<acute>ret__struct_cap_C = \<^bsup>s\<^esup>ret__struct_cap_C\<rbrace>}
 2. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 3. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 7. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> ?R'7383 cap_rights capa v x \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7383 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7381 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x8. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ArchObjectCap x8) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8) \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 2. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> ?R'7369 cap_rights capa v x}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))}
flex-flex pairs:
\<lambda>cap_rights capa. ?R'7369 cap_rights capa (SCAST(32 signed \<rightarrow> 32) true) \<equiv>\<^sup>? \<lambda>cap_rights capa x8. ?R'7367 cap_rights cap_rights capa capa x8 (SCAST(32 signed \<rightarrow> 32) true) x8 proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x91 x92 x93) [SKIP] (return (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant R) cap)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?R''3280 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x91 x92 x93) [SKIP] (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> ?R''3280 cap_rights capa v x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?G'7861 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x91 x92 x93 ret__unsigned) [SKIP] (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'7861 cap_rights capa v x xa xb va}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?G'7861 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x91 x92 x93 (cap_get_tag capa)) [SKIP] (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R))) (IF False THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF True THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'7861 cap_rights capa v x xa xb va}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3320 cap_rights capa x91 x92 x93) (?G'7861 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x91 x92 x93 (cap_get_tag capa)) [SKIP] (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R))) (lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_')
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> ?R3320 cap_rights capa x xa xb s) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'7861 cap_rights capa v x xa xb va}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'8506 cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned \<sigma>) lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'8506 cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 6. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v. cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> (\<forall>t. ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa) \<longrightarrow> (\<forall>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights) \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<and> (\<forall>t. cap_reply_cap_lift (ret__struct_cap_C_' t) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && mask 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R)) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := capReplyCanGrant_CL (cap_reply_cap_lift capa), unsigned_eret_2_' := capAllowGrant_CL (seL4_CapRights_lift cap_rights), new_cap_' := ret__struct_cap_C_' t, ret__struct_cap_C_' := ret__struct_cap_C_' t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' t)))))}
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x91 x92 x93 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.ReplyCap x91 x92 x93; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<exists>t. ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capAllowGrant_CL (seL4_CapRights_lift cap_rights)) \<longrightarrow> (\<forall>t. cap_reply_cap_lift (ret__struct_cap_C_' t) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap \<longrightarrow> (\<sigma>, s) \<in> rf_sr \<and> ccap_relation (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R)) (ret__struct_cap_C_' t))}
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa x91 x92 x93 \<sigma> x t ta tb. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.ReplyCap x91 x92 x93) capa; cap = capability.ReplyCap x91 x92 x93; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa); ret__unsigned_' ta = capAllowGrant_CL (seL4_CapRights_lift cap_rights); cap_reply_cap_lift (ret__struct_cap_C_' tb) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tb) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R)) (ret__struct_cap_C_' tb)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa x91 x92 x93 \<sigma> x t ta tb. \<lbrakk>ccap_rights_relation R cap_rights; Some (capability.ReplyCap x91 x92 x93) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; cap = capability.ReplyCap x91 x92 x93; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa); ret__unsigned_' ta = capAllowGrant_CL (seL4_CapRights_lift cap_rights); cap_reply_cap_lift (ret__struct_cap_C_' tb) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tb) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> Some (capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R)) = map_option cap_to_H (cap_lift (ret__struct_cap_C_' tb)) \<and> c_valid_cap (ret__struct_cap_C_' tb)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa x91 x92 x93 \<sigma> x t ta tb. \<lbrakk>ccap_rights_relation R cap_rights; Some (capability.ReplyCap x91 x92 x93) = map_option cap_to_H (cap_lift capa) \<and> c_valid_cap capa; cap = capability.ReplyCap x91 x92 x93; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa); ret__unsigned_' ta = capAllowGrant_CL (seL4_CapRights_lift cap_rights); cap_reply_cap_lift (ret__struct_cap_C_' tb) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tb) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap\<rbrakk> \<Longrightarrow> capability.ReplyCap x91 x92 (x93 \<and> capAllowGrant R) = cap_to_H (Cap_reply_cap (cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>))
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa x91 x92 x93 \<sigma> x t ta tb. \<lbrakk>ccap_rights_relation R cap_rights; cap = capability.ReplyCap x91 x92 x93; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa); ret__unsigned_' ta = capAllowGrant_CL (seL4_CapRights_lift cap_rights); cap_reply_cap_lift (ret__struct_cap_C_' tb) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tb) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; Some (capability.ReplyCap x91 x92 x93) = map_option cap_to_H (cap_lift capa); c_valid_cap capa\<rbrakk> \<Longrightarrow> x91 = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift capa))) \<and> x92 = to_bool (capReplyMaster_CL (cap_reply_cap_lift capa)) \<and> (x93 \<and> capAllowGrant R) = to_bool ((capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa x91 x92 x93 \<sigma> x t ta tb x2. \<lbrakk>c_valid_cap capa; ccap_rights_relation R cap_rights; cap = cap_to_H x2; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa); ret__unsigned_' ta = capAllowGrant_CL (seL4_CapRights_lift cap_rights); cap_reply_cap_lift (ret__struct_cap_C_' tb) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tb) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_lift capa = Some x2; capability.ReplyCap x91 x92 x93 = cap_to_H x2\<rbrakk> \<Longrightarrow> x91 = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift capa))) \<and> x92 = to_bool (capReplyMaster_CL (cap_reply_cap_lift capa)) \<and> (x93 \<and> capAllowGrant R) = to_bool ((capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa \<sigma> x t ta tb x5. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = capReplyCanGrant_CL (cap_reply_cap_lift capa); ret__unsigned_' ta = capAllowGrant_CL (seL4_CapRights_lift cap_rights); cap_reply_cap_lift (ret__struct_cap_C_' tb) = cap_reply_cap_lift capa\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tb) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_lift capa = Some (Cap_reply_cap x5); c_valid_cap capa; ccap_rights_relation R cap_rights; cap = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL x5))) (to_bool (capReplyMaster_CL x5)) (to_bool (capReplyCanGrant_CL x5))\<rbrakk> \<Longrightarrow> ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL x5)) = ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL (cap_reply_cap_lift capa))) \<and> to_bool (capReplyMaster_CL x5) = to_bool (capReplyMaster_CL (cap_reply_cap_lift capa)) \<and> (to_bool (capReplyCanGrant_CL x5) \<and> capAllowGrant R) = to_bool ((capReplyCanGrant_CL (cap_reply_cap_lift capa) && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa \<sigma> x t ta tb x5. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = capReplyCanGrant_CL x5; ret__unsigned_' ta = capAllowGrant_CL (seL4_CapRights_lift cap_rights); (case cap_lift (ret__struct_cap_C_' tb) of Some (Cap_reply_cap rec) \<Rightarrow> rec) = x5\<lparr>capReplyCanGrant_CL := (capReplyCanGrant_CL x5 && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1\<rparr>; cap_get_tag (ret__struct_cap_C_' tb) = SCAST(32 signed \<rightarrow> 32) cap_reply_cap; cap_lift capa = Some (Cap_reply_cap x5); c_valid_cap capa; ccap_rights_relation R cap_rights; cap = capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL x5))) (to_bool (capReplyMaster_CL x5)) (to_bool (capReplyCanGrant_CL x5))\<rbrakk> \<Longrightarrow> (to_bool (capReplyCanGrant_CL x5) \<and> capAllowGrant R) = to_bool ((capReplyCanGrant_CL x5 && capAllowGrant_CL (seL4_CapRights_lift cap_rights)) && 1)
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x101 x102 x103 x104) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?R''3278 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x101 x102 x103 x104) [SKIP] (return (capability.UntypedCap x101 x102 x103 x104)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> ?R''3278 cap_rights capa v x xa xb xc}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?G'8682 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x101 x102 x103 x104 ret__unsigned) [SKIP] (return (capability.UntypedCap x101 x102 x103 x104)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'8682 cap_rights capa v x xa xb xc va}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?G'8682 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x101 x102 x103 x104 (cap_get_tag capa)) [SKIP] (return (capability.UntypedCap x101 x102 x103 x104)) (IF True THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'8682 cap_rights capa v x xa xb xc va}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3316 cap_rights capa x101 x102 x103 x104) (?G'8682 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x101 x102 x103 x104 (cap_get_tag capa)) [SKIP] (return (capability.UntypedCap x101 x102 x103 x104)) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> ?R3316 cap_rights capa x xa xb xc s) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'8682 cap_rights capa v x xa xb xc va}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.UntypedCap x101 x102 x103 x104) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.UntypedCap x101 x102 x103 x104) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'9154 cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.UntypedCap x101 x102 x103 x104) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'9154 cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 5. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x101 x102 x103 x104 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.UntypedCap x101 x102 x103 x104) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.UntypedCap x101 x102 x103 x104; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.UntypedCap x101 x102 x103 x104) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap)) x111 x112 x113 x114) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?R''3276 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x111 x112 x113 x114) [SKIP] (return (capability.CNodeCap x111 x112 x113 x114)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> ?R''3276 cap_rights capa v x xa xb xc}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?G'9172 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x111 x112 x113 x114 ret__unsigned) [SKIP] (return (capability.CNodeCap x111 x112 x113 x114)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'9172 cap_rights capa v x xa xb xc va}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?G'9172 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x111 x112 x113 x114 (cap_get_tag capa)) [SKIP] (return (capability.CNodeCap x111 x112 x113 x114)) (IF True THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'9172 cap_rights capa v x xa xb xc va}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3312 cap_rights capa x111 x112 x113 x114) (?G'9172 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) x111 x112 x113 x114 (cap_get_tag capa)) [SKIP] (return (capability.CNodeCap x111 x112 x113 x114)) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> ?R3312 cap_rights capa x xa xb xc s) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'9172 cap_rights capa v x xa xb xc va}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.CNodeCap x111 x112 x113 x114) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.CNodeCap x111 x112 x113 x114) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'9644 cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.CNodeCap x111 x112 x113 x114) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'9644 cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned \<sigma>
 3. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 4. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long x111 x112 x113 x114 ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.CNodeCap x111 x112 x113 x114) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa x111 x112 x113 x114 \<sigma> x. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation (capability.CNodeCap x111 x112 x113 x114) capa; cap = capability.CNodeCap x111 x112 x113 x114; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (return (capability.CNodeCap x111 x112 x113 x114) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> ccap_relation rv capa
 2. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; ret__unsigned_long = from_bool (isArchCap (\<lambda>_. True) cap); cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (from_bool (isArchCap (\<lambda>_. True) cap))) [SKIP] (return cap) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__struct_cap_C :== CALL Arch_maskCapRights_'proc(cap_rights,capa);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI))
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?R''3274 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (return capability.IRQControlCap) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(capa);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> ?R''3274 cap_rights capa v}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?G'9669 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) ret__unsigned) [SKIP] (return capability.IRQControlCap) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_zombie_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_domain_cap \<or> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_reply_cap THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'9669 cap_rights capa v va}}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?G'9669 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (return capability.IRQControlCap) (IF True THEN
  return_C ret__struct_cap_C_'_update (\<lambda>s. capa)
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrant_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capCanGrantReply_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrantReply_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_endpoint_cap_set_capCanGrantReply_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanSend_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowWrite_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanSend_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnCanReceive_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowRead_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_notification_cap_set_capNtfnCanReceive_'proc(\<acute>new_cap,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  IF False THEN
  lvar_nondet_init new_cap_' new_cap_'_update;;
\<acute>ret__unsigned :== CALL cap_reply_cap_get_capReplyCanGrant_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL seL4_CapRights_get_capAllowGrant_'proc(cap_rights);;
\<acute>new_cap :== CALL cap_reply_cap_set_capReplyCanGrant_'proc(capa,\<acute>ret__unsigned && \<acute>unsigned_eret_2);;
return_C ret__struct_cap_C_'_update new_cap_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'9669 cap_rights capa v va}}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?R3298 cap_rights capa) (?G'9669 cap_rights capa (SCAST(32 signed \<rightarrow> 32) false) (cap_get_tag capa)) [SKIP] (return capability.IRQControlCap) (return_C ret__struct_cap_C_'_update (\<lambda>s. capa))
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> ?R3298 cap_rights capa s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'9669 cap_rights capa v va}}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.IRQControlCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.IRQControlCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}))))))))))} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?P'10141 cap_rights capa ret__unsigned_long ret__unsigned \<sigma>) return_C ret__struct_cap_C_'_update (\<lambda>s. capa) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return capability.IRQControlCap \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'10141 cap_rights capa ret__unsigned_long ret__unsigned \<sigma>
 3. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}))))))))))} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights capa ret__unsigned_long ret__unsigned \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation capability.IRQControlCap capa; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; cap = capability.IRQControlCap; ret__unsigned = cap_get_tag capa\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return capability.IRQControlCap \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := capa, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv capa}
 2. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}))))))))))} proof (prove)
goal (1 subgoal):
 1. \<And>cap_rights capa s s'. \<lbrakk>ccap_rights_relation R cap_rights; ccap_relation cap capa; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. cap = capability.ThreadCap x \<longrightarrow> True) \<and> (cap = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.NotificationCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x. cap = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> True) \<and> (cap = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xa xb. cap = capability.Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. cap = capability.ArchObjectCap x \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s) \<and> (\<forall>x xa xb. cap = capability.ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb xc. cap = capability.CNodeCap x xa xb xc \<longrightarrow> True) \<and> (cap = capability.IRQControlCap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. \<forall>x. s \<in> {s. cap = capability.ThreadCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. cap = capability.NullCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.NotificationCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.IRQHandlerCap x \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. cap = capability.EndpointCap x xa xb xc xd xe \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}}}} \<inter> ({s. cap = capability.DomainCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.Zombie x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. cap = capability.ArchObjectCap x \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. capa) (cap_rights_mask_'_update (\<lambda>_. cap_rights) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap x) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace> \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift capa))))) \<and> (cap_get_tag capa \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag capa \<longrightarrow> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) \<longrightarrow> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa)) && mask 2 = UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift capa))))))\<rbrace>}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. cap = capability.ReplyCap x xa xb \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.UntypedCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. cap = capability.CNodeCap x xa xb xc \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}}}}} \<inter> {s. cap = capability.IRQControlCap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}}))))))))))} proof (prove)
goal:
No subgoals!