theory CSpace_C

lemma updateCapData_spec:
  "\<forall>cap. \<Gamma> \<turnstile> \<lbrace> ccap_relation cap \<acute>cap \<and> preserve = to_bool (\<acute>preserve) \<and> newData = \<acute>newData\<rbrace>
  Call updateCapData_'proc
  \<lbrace>  ccap_relation (updateCapData preserve newData cap) \<acute>ret__struct_cap_C \<rbrace>" supply if_cong[cong] apply (rule allI, rule conseqPre) apply vcg apply (clarsimp simp: if_1_0_0) apply (simp add: updateCapData_def) apply (case_tac cap, simp_all add: cap_get_tag_isCap_unfolded_H_cap
                                     isCap_simps isArchCap_tag_def2 cap_tag_defs Let_def)
  \<comment> \<open>NotificationCap\<close> apply clarsimp apply (frule cap_get_tag_isCap_unfolded_H_cap(3)) apply (frule (1) iffD1[OF cap_get_tag_NotificationCap]) apply clarsimp apply (intro conjI impI)
     \<comment> \<open>preserve is zero and capNtfnBadge_CL \<dots> = 0\<close> apply clarsimp apply (clarsimp simp:cap_notification_cap_lift_def cap_lift_def cap_tag_defs) apply (simp add: ccap_relation_def cap_lift_def cap_tag_defs cap_to_H_def)
     \<comment> \<open>preserve is zero and capNtfnBadge_CL \<dots> \<noteq> 0\<close> apply clarsimp apply (simp add: ccap_relation_NullCap_iff cap_tag_defs)
     \<comment> \<open>preserve is not zero\<close> apply clarsimp apply (simp add: to_bool_def) apply (case_tac "preserve_' x = 0 \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))= 0",
            clarsimp) apply (simp add: if_not_P) apply (simp add: ccap_relation_NullCap_iff cap_tag_defs)

  \<comment> \<open>EndpointCap\<close> apply clarsimp apply (frule cap_get_tag_isCap_unfolded_H_cap(4)) apply (frule (1) iffD1[OF cap_get_tag_EndpointCap]) apply clarsimp apply (intro impI conjI)
    \<comment> \<open>preserve is zero and capNtfnBadge_CL \<dots> = 0\<close> apply clarsimp apply (clarsimp simp:cap_endpoint_cap_lift_def cap_lift_def cap_tag_defs) apply (simp add: ccap_relation_def cap_lift_def cap_tag_defs cap_to_H_def)
    \<comment> \<open>preserve is zero and capNtfnBadge_CL \<dots> \<noteq> 0\<close> apply clarsimp apply (simp add: ccap_relation_NullCap_iff cap_tag_defs)
    \<comment> \<open>preserve is not zero\<close> apply clarsimp apply (simp add: to_bool_def) apply (case_tac "preserve_' x = 0 \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))= 0", clarsimp) apply (simp add: if_not_P) apply (simp add: ccap_relation_NullCap_iff cap_tag_defs)

  \<comment> \<open>ArchObjectCap\<close> apply clarsimp apply (frule cap_get_tag_isArchCap_unfolded_H_cap) apply (simp add: isArchCap_tag_def2) apply (simp add: ARM_H.updateCapData_def)

  \<comment> \<open>CNodeCap\<close> apply (clarsimp simp: cteRightsBits_def cteGuardBits_def) apply (frule cap_get_tag_isCap_unfolded_H_cap(10)) apply (frule (1) iffD1[OF cap_get_tag_CNodeCap]) apply clarsimp apply (thin_tac "ccap_relation x y" for x y) apply (thin_tac "ret__unsigned_long_' t = v" for t v)+ apply (simp add: seL4_CNode_CapData_lift_def fupdate_def word_size word_less_nat_alt mask_def
             cong: if_cong) apply (simp only: unat_word_ariths(1)) apply (rule ssubst [OF nat_mod_eq' [where n = "2 ^ len_of TYPE(32)"]])
   \<comment> \<open>unat (\<dots> && 0x1F) +  unat (\<dots> mod 0x20) < 2 ^ len_of TYPE(32)\<close> apply (rule order_le_less_trans, rule add_le_mono) apply (rule word_le_nat_alt[THEN iffD1]) apply (rule word_and_le1) apply (simp add: cap_cnode_cap_lift_def cap_lift_cnode_cap) apply (rule word_le_nat_alt[THEN iffD1]) apply (rule word_and_le1) apply (simp add: mask_def) apply (simp add: word_sle_def) apply (rule conjI, clarsimp simp:  ccap_relation_NullCap_iff cap_tag_defs) apply clarsimp apply (rule conjI) apply (rule unat_less_power[where sz=5, simplified], simp add: word_bits_def) apply (rule and_mask_less'[where n=5, unfolded mask_def, simplified], simp) apply clarsimp apply (simp add: ccap_relation_def c_valid_cap_def cl_valid_cap_def
                   cap_lift_cnode_cap cap_tag_defs cap_to_H_simps
                   cap_cnode_cap_lift_def) apply (simp add: word_bw_assocs word_bw_comms word_bw_lcs) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>cap. \<Gamma>\<turnstile> \<lbrace>ccap_relation cap \<acute>cap \<and> preserve = to_bool \<acute>preserve \<and> newData = \<acute>newData\<rbrace> Call updateCapData_'proc \<lbrace>ccap_relation (global.updateCapData preserve newData cap) \<acute>ret__struct_cap_C\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<forall>cap. \<Gamma>\<turnstile> \<lbrace>ccap_relation cap \<acute>cap \<and> preserve = to_bool \<acute>preserve \<and> newData = \<acute>newData\<rbrace> Call updateCapData_'proc \<lbrace>ccap_relation (global.updateCapData preserve newData cap) \<acute>ret__struct_cap_C\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<Gamma>\<turnstile> (?P'2 cap) Call updateCapData_'proc \<lbrace>ccap_relation (global.updateCapData preserve newData cap) \<acute>ret__struct_cap_C\<rbrace>
 2. \<And>cap. \<lbrace>ccap_relation cap \<acute>cap \<and> preserve = to_bool \<acute>preserve \<and> newData = \<acute>newData\<rbrace> \<subseteq> ?P'2 cap proof (prove)
goal (1 subgoal):
 1. \<And>cap. \<lbrace>ccap_relation cap \<acute>cap \<and> preserve = to_bool \<acute>preserve \<and> newData = \<acute>newData\<rbrace> \<subseteq> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag \<acute>cap)) \<longrightarrow> (from_bool (isArchCap_tag (cap_get_tag \<acute>cap)) \<noteq> 0 \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<acute>cap) \<and> (from_bool (isArchCap_tag (cap_get_tag \<acute>cap)) = 0 \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = cap_get_tag \<acute>cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag \<acute>cap \<longrightarrow> ((if \<acute>preserve = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift \<acute>cap) \<longrightarrow> ((if capEPBadge_CL (cap_endpoint_cap_lift \<acute>cap) = SCAST(32 signed \<rightarrow> 32) 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = cap_endpoint_cap_lift \<acute>cap\<lparr>capEPBadge_CL := UCAST(32 \<rightarrow> 32) \<acute>newData && mask 28\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = cap_get_tag \<acute>cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C)) \<and> ((if capEPBadge_CL (cap_endpoint_cap_lift \<acute>cap) = SCAST(32 signed \<rightarrow> 32) 0 then 1 else 0) = 0 \<longrightarrow> (\<forall>t. cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C)))) \<and> ((if \<acute>preserve = 0 then 1 else 0) = 0 \<longrightarrow> (\<forall>t. cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag \<acute>cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag \<acute>cap \<longrightarrow> ((if \<acute>preserve = 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capNtfnBadge_CL (cap_notification_cap_lift \<acute>cap) \<longrightarrow> ((if capNtfnBadge_CL (cap_notification_cap_lift \<acute>cap) = SCAST(32 signed \<rightarrow> 32) 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = cap_notification_cap_lift \<acute>cap\<lparr>capNtfnBadge_CL := UCAST(32 \<rightarrow> 32) \<acute>newData && mask 28\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = cap_get_tag \<acute>cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C)) \<and> ((if capNtfnBadge_CL (cap_notification_cap_lift \<acute>cap) = SCAST(32 signed \<rightarrow> 32) 0 then 1 else 0) = 0 \<longrightarrow> (\<forall>t. cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C)))) \<and> ((if \<acute>preserve = 0 then 1 else 0) = 0 \<longrightarrow> (\<forall>t. cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag \<acute>cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag \<acute>cap \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0)))) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift \<acute>cap) \<longrightarrow> 0 \<le>s 5 \<and> unat 1 * 2 ^ unat 5 < 2 ^ 31 \<and> 0 \<le>s 1 \<and> (SCAST(32 signed \<rightarrow> 32) (1 << unat 5) < UCAST(32 \<rightarrow> 32) (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0))))) + UCAST(32 \<rightarrow> 32) (capCNodeRadix_CL (cap_cnode_cap_lift \<acute>cap)) \<longrightarrow> (\<forall>t. cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C)) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) (1 << unat 5) < UCAST(32 \<rightarrow> 32) (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0))))) + UCAST(32 \<rightarrow> 32) (capCNodeRadix_CL (cap_cnode_cap_lift \<acute>cap)) \<longrightarrow> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0)))) \<longrightarrow> UCAST(32 \<rightarrow> 32) (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>t. cap_cnode_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = cap_cnode_cap_lift \<acute>cap\<lparr>capCNodeGuard_CL := UCAST(32 \<rightarrow> 32) (UCAST(32 \<rightarrow> 32) (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0))))) && (1 << unat (UCAST(32 \<rightarrow> 32) (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0))))))) - 1) && mask 18\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = cap_get_tag \<acute>cap \<longrightarrow> (\<forall>t. cap_cnode_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = cap_cnode_cap_lift \<acute>cap\<lparr>capCNodeGuard_CL := UCAST(32 \<rightarrow> 32) (UCAST(32 \<rightarrow> 32) (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0))))) && (1 << unat (UCAST(32 \<rightarrow> 32) (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0))))))) - 1) && mask 18, capCNodeGuardSize_CL := UCAST(32 \<rightarrow> 32) (UCAST(32 \<rightarrow> 32) (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C.words_C_update (fupdate 0 (\<lambda>_. UCAST(32 \<rightarrow> 32) \<acute>newData)) (seL4_CNode_CapData_C (ARRAY _. 0)))))) && mask 5\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = cap_get_tag \<acute>cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<^bsup>t\<^esup>ret__struct_cap_C))))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag \<acute>cap \<longrightarrow> ccap_relation (global.updateCapData preserve newData cap) \<acute>cap)))))\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>cap x t. \<lbrakk>ccap_relation cap (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (isArchCap_tag (cap_get_tag (cap_' x)))\<rbrakk> \<Longrightarrow> (isArchCap_tag (cap_get_tag (cap_' x)) \<longrightarrow> ccap_relation (global.updateCapData (to_bool (preserve_' x)) (newData_' x) cap) (cap_' x)) \<and> (from_bool (isArchCap_tag (cap_get_tag (cap_' x))) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cap_' x) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (global.updateCapData False (newData_' x) cap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData False (newData_' x) cap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData (to_bool (preserve_' x)) (newData_' x) cap) (ret__struct_cap_C_' t)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cap_' x) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cap_' x) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (global.updateCapData False (newData_' x) cap) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData False (newData_' x) cap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData (to_bool (preserve_' x)) (newData_' x) cap) (ret__struct_cap_C_' t)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cap_' x) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag (cap_' x) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (global.updateCapData (to_bool (preserve_' x)) (newData_' x) cap) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (global.updateCapData (to_bool (preserve_' x)) (newData_' x) cap) (ret__struct_cap_C_' t))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (global.updateCapData (to_bool (preserve_' x)) (newData_' x) cap) (cap_' x))))) proof (prove)
goal (1 subgoal):
 1. \<And>cap x t. \<lbrakk>ccap_relation cap (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (isArchCap_tag (cap_get_tag (cap_' x)))\<rbrakk> \<Longrightarrow> (isArchCap_tag (cap_get_tag (cap_' x)) \<longrightarrow> ccap_relation (if isEndpointCap cap then if \<not> to_bool (preserve_' x) \<and> capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if \<not> to_bool (preserve_' x) \<and> capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) (capCap cap) else cap) (cap_' x)) \<and> (from_bool (isArchCap_tag (cap_get_tag (cap_' x))) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap = cap_get_tag (cap_' x) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (if isEndpointCap cap then if capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData False (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (if isEndpointCap cap then if capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData False (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (if isEndpointCap cap then if \<not> to_bool (preserve_' x) \<and> capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if \<not> to_bool (preserve_' x) \<and> capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<noteq> cap_get_tag (cap_' x) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap = cap_get_tag (cap_' x) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (if isEndpointCap cap then if capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData False (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (if isEndpointCap cap then if capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData False (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (if isEndpointCap cap then if \<not> to_bool (preserve_' x) \<and> capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if \<not> to_bool (preserve_' x) \<and> capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<noteq> cap_get_tag (cap_' x) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap = cap_get_tag (cap_' x) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> ccap_relation (if isEndpointCap cap then if \<not> to_bool (preserve_' x) \<and> capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if \<not> to_bool (preserve_' x) \<and> capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (if isEndpointCap cap then if \<not> to_bool (preserve_' x) \<and> capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if \<not> to_bool (preserve_' x) \<and> capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) (capCap cap) else cap) (ret__struct_cap_C_' t))))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<noteq> cap_get_tag (cap_' x) \<longrightarrow> ccap_relation (if isEndpointCap cap then if \<not> to_bool (preserve_' x) \<and> capEPBadge cap = 0 then capEPBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isNotificationCap cap then if \<not> to_bool (preserve_' x) \<and> capNtfnBadge cap = 0 then capNtfnBadge_update (\<lambda>_. newData_' x && mask 28) cap else capability.NullCap else if isCNodeCap cap then let guardSize = unat ((newData_' x >> cteRightsBits) && mask 5) in if size (newData_' x) < guardSize + capCNodeBits cap then capability.NullCap else capCNodeGuardSize_update (\<lambda>_. guardSize) (capCNodeGuard_update (\<lambda>_. (newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask guardSize) cap) else if isArchObjectCap cap then Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) (capCap cap) else cap) (cap_' x))))) proof (prove)
goal (4 subgoals):
 1. \<And>cap x t x31 x32 x33 x34. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 6) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t x31 x32 x33 x34 ta. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t x31 x32 x33 x34 ta. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t x31 x32 x33 x34 ta. \<lbrakk>ccap_relation (capability.NotificationCap x31 x32 x33 x34) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; capability.NotificationCap x31 x32 x33 x34 = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x32 = 0 then capability.NotificationCap x31 (newData_' x && mask 28) x33 x34 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (6 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)); capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (ret__struct_cap_C_' t)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)); capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 3. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 4. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 5. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 6. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (6 subgoals):
 1. \<And>x t ta tb tc. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) 0 (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; \<not> preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x = 0; capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0; ret__unsigned_' tb = 0; cap_notification_cap_lift (ret__struct_cap_C_' tc) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = 6\<rbrakk> \<Longrightarrow> ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (ret__struct_cap_C_' tc)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)); capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 3. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 4. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 5. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 6. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (6 subgoals):
 1. \<And>x t ta tb tc. \<lbrakk>ccap_relation (capability.NotificationCap (cap_C.words_C (cap_' x).[0] && ~~ mask 4) 0 (to_bool (cap_C.words_C (cap_' x).[Suc 0] && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> Suc 0) && 1))) (cap_' x); newData = newData_' x; \<not> preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = 6; preserve_' x = 0; (cap_C.words_C (cap_' x).[Suc 0] >> 4) && mask 28 = 0; ret__unsigned_' tb = 0; cap_get_tag (ret__struct_cap_C_' tc) = 6; (cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] >> 4) && mask 28 = newData_' x && mask 28; (cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] >> Suc 0) && 1 = (cap_C.words_C (cap_' x).[Suc 0] >> Suc 0) && 1; cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] && 1 = cap_C.words_C (cap_' x).[Suc 0] && 1; cap_C.words_C (ret__struct_cap_C_' tc).[0] && ~~ mask 4 = cap_C.words_C (cap_' x).[0] && ~~ mask 4\<rbrakk> \<Longrightarrow> ccap_relation (capability.NotificationCap (cap_C.words_C (cap_' x).[0] && ~~ mask 4) (newData_' x && mask 28) (to_bool (cap_C.words_C (cap_' x).[Suc 0] && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> Suc 0) && 1))) (ret__struct_cap_C_' tc)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)); capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 3. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 4. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 5. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 6. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (5 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)); capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 3. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 4. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 5. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (5 subgoals):
 1. \<And>x t ta tb tc. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; \<not> preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x = 0; capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0; ret__unsigned_' tb = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)); cap_get_tag (ret__struct_cap_C_' tc) = 0\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tc)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 3. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 4. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 5. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0\<rbrakk> \<Longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 then capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' tb)
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0)) (cap_' x); newData = newData_' x; preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tb)
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0)) (cap_' x); newData = newData_' x; preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0; \<not> (preserve_' x = 0 \<and> capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0)\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tb)
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift (cap_' x))) (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) (capNtfnCanSend_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0) (capNtfnCanReceive_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0)) (cap_' x); newData = newData_' x; preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 6; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tb)
 2. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>cap x t x51 x52 x53 x54 x55 x56. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 4) \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t x51 x52 x53 x54 x55 x56 ta. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t x51 x52 x53 x54 x55 x56 ta. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t x51 x52 x53 x54 x55 x56 ta. \<lbrakk>ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; capability.EndpointCap x51 x52 x53 x54 x55 x56 = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> x52 = 0 then capability.EndpointCap x51 (newData_' x && mask 28) x53 x54 x55 x56 else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap\<rbrakk> \<Longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)))
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (5 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)); capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (ret__struct_cap_C_' t)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)); capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 3. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 4. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 5. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (5 subgoals):
 1. \<And>x t ta tb tc. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) 0 (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; \<not> preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x = 0; capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0; ret__unsigned_' tb = 0; cap_endpoint_cap_lift (ret__struct_cap_C_' tc) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr>; cap_get_tag (ret__struct_cap_C_' tc) = 4\<rbrakk> \<Longrightarrow> ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (ret__struct_cap_C_' tc)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)); capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 3. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 4. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 5. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (5 subgoals):
 1. \<And>x t ta tb tc. \<lbrakk>ccap_relation (capability.EndpointCap (cap_C.words_C (cap_' x).[Suc 0] && ~~ mask 4) 0 (to_bool (cap_C.words_C (cap_' x).[Suc 0] && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> Suc 0) && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> 2) && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> 3) && 1))) (cap_' x); newData = newData_' x; \<not> preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = 4; preserve_' x = 0; (cap_C.words_C (cap_' x).[0] >> 4) && mask 28 = 0; ret__unsigned_' tb = 0; cap_get_tag (ret__struct_cap_C_' tc) = 4; (cap_C.words_C (ret__struct_cap_C_' tc).[0] >> 4) && mask 28 = newData_' x && mask 28; (cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] >> 3) && 1 = (cap_C.words_C (cap_' x).[Suc 0] >> 3) && 1; (cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] >> 2) && 1 = (cap_C.words_C (cap_' x).[Suc 0] >> 2) && 1; cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] && 1 = cap_C.words_C (cap_' x).[Suc 0] && 1; (cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] >> Suc 0) && 1 = (cap_C.words_C (cap_' x).[Suc 0] >> Suc 0) && 1; cap_C.words_C (ret__struct_cap_C_' tc).[Suc 0] && ~~ mask 4 = cap_C.words_C (cap_' x).[Suc 0] && ~~ mask 4\<rbrakk> \<Longrightarrow> ccap_relation (capability.EndpointCap (cap_C.words_C (cap_' x).[Suc 0] && ~~ mask 4) (newData_' x && mask 28) (to_bool (cap_C.words_C (cap_' x).[Suc 0] && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> Suc 0) && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> 2) && 1)) (to_bool ((cap_C.words_C (cap_' x).[Suc 0] >> 3) && 1))) (ret__struct_cap_C_' tc)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)); capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 3. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 4. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 5. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x = 0; \<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)); capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x t ta tb tc. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; \<not> preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x = 0; capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0; ret__unsigned_' tb = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)); cap_get_tag (ret__struct_cap_C_' tc) = 0\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tc)
 2. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 3. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 4. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t ta. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' t)
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0\<rbrakk> \<Longrightarrow> ccap_relation (if \<not> to_bool (preserve_' x) \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 then capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (newData_' x && mask 28) (to_bool (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)))) else capability.NullCap) (ret__struct_cap_C_' tb)
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0)) (cap_' x); newData = newData_' x; preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tb)
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0)) (cap_' x); newData = newData_' x; preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0; \<not> (preserve_' x = 0 \<and> capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0)\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tb)
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x t ta tb. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift (cap_' x))) (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) (capCanSend_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanReceive_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanGrant_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0) (capCanGrantReply_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0)) (cap_' x); newData = newData_' x; preserve; ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 4; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; preserve_' x \<noteq> 0; cap_get_tag (ret__struct_cap_C_' tb) = 0\<rbrakk> \<Longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' tb)
 2. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 3. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 2. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (2 subgoals):
 1. \<And>x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1)\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 2. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (2 subgoals):
 1. \<And>x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = from_bool (cap_get_tag (cap_' x) && 1 = 1); isArchCap_tag (cap_get_tag (cap_' x))\<rbrakk> \<Longrightarrow> (cap_get_tag (cap_' x) && 1 = 1 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)) \<and> (from_bool (cap_get_tag (cap_' x) && 1 = 1) = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = cap_get_tag (cap_' x)) \<longrightarrow> (cap_get_tag (cap_' x) = 4 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPBadge_CL (cap_endpoint_cap_lift (cap_' x))) \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_endpoint_cap_lift (ret__struct_cap_C_' t) = cap_endpoint_cap_lift (cap_' x)\<lparr>capEPBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 4 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capEPBadge_CL (cap_endpoint_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 4 \<longrightarrow> (cap_get_tag (cap_' x) = 6 \<longrightarrow> (preserve_' x = 0 \<longrightarrow> (\<exists>t. ret__unsigned_' t = capNtfnBadge_CL (cap_notification_cap_lift (cap_' x))) \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) = 0 \<longrightarrow> (\<forall>t. cap_notification_cap_lift (ret__struct_cap_C_' t) = cap_notification_cap_lift (cap_' x)\<lparr>capNtfnBadge_CL := newData_' x && mask 28\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 6 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (capNtfnBadge_CL (cap_notification_cap_lift (cap_' x)) \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData False (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (preserve_' x \<noteq> 0 \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t)))) \<and> (cap_get_tag (cap_' x) \<noteq> 6 \<longrightarrow> (cap_get_tag (cap_' x) = 0xA \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (ret__struct_cap_C_' t))))) \<and> (cap_get_tag (cap_' x) \<noteq> 0xA \<longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)))))
 2. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (2 subgoals):
 1. \<And>x t x8. \<lbrakk>ccap_relation (capability.ArchObjectCap x8) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) true; cap_get_tag (cap_' x) && 1 = 1\<rbrakk> \<Longrightarrow> ccap_relation (Arch.updateCapData (to_bool (preserve_' x)) (newData_' x) x8) (cap_' x)
 2. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap x t x111 x112 x113 x114. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> (\<exists>t. ret__unsigned_' t = 0xA) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> cteRightsBits) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> cteRightsBits + 5) && mask cteGuardBits && mask (unat ((newData_' x >> cteRightsBits) && mask 5))) (unat ((newData_' x >> cteRightsBits) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x t x111 x112 x113 x114 ta tb tc. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 0xA; ret__unsigned_' tb = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))); ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))\<rbrakk> \<Longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x t x111 x112 x113 x114 ta tb tc. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 0xA; ret__unsigned_' tb = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))); ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x t x111 x112 x113 x114 ta tb tc. \<lbrakk>ccap_relation (capability.CNodeCap x111 x112 x113 x114) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 0xA; ret__unsigned_' tb = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))); ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; capability.CNodeCap x111 x112 x113 x114 = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) (capCNodeGuard_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' x))))\<rbrakk> \<Longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + x112 then capability.NullCap else capability.CNodeCap x111 x112 ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x t ta tb tc. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) (capCNodeGuard_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' x))))) (cap_' x); newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 0xA; ret__unsigned_' tb = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))); ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x t ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) false; ret__unsigned_' ta = 0xA; ret__unsigned_' tb = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))); ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x t ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))); ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t))) \<and> (\<not> 0x20 < guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)) \<longrightarrow> (\<exists>t. ret__unsigned_' t = guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) \<longrightarrow> guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) < 0x20 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (guard_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && 2 ^ unat (guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0))))) - 1) && mask 18, capCNodeGuardSize_CL := guardSize_CL (seL4_CNode_CapData_lift (seL4_CNode_CapData_C (fupdate 0 (\<lambda>_. newData_' x) (ARRAY _. 0)))) && mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if size (newData_' x) < unat ((newData_' x >> 3) && mask 5) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && mask 18 && mask (unat ((newData_' x >> 3) && mask 5))) (unat ((newData_' x >> 3) && mask 5))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat (((newData_' x >> 3) && 0x1F) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat (((newData_' x >> 3) && 0x1F) + capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < (unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) mod 2 ^ LENGTH(32) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < (unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) mod 2 ^ LENGTH(32) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (2 subgoals):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) < 2 ^ LENGTH(32)
 2. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat ((newData_' x >> 3) && 0x1F) \<le> ?j441 x ta tb tc
 2. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<le> ?l441 x ta tb tc
 3. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> ?j441 x ta tb tc + ?l441 x ta tb tc < 2 ^ LENGTH(32)
 4. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (4 subgoals):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (newData_' x >> 3) && 0x1F \<le> ?b445 x ta tb tc
 2. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<le> ?l441 x ta tb tc
 3. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat (?b445 x ta tb tc) + ?l441 x ta tb tc < 2 ^ LENGTH(32)
 4. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<le> ?l441 x ta tb tc
 2. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat 0x1F + ?l441 x ta tb tc < 2 ^ LENGTH(32)
 3. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = (cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5) \<le> ?l441 x ta tb tc
 2. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat 0x1F + ?l441 x ta tb tc < 2 ^ LENGTH(32)
 3. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (3 subgoals):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = (cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5; cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5 \<le> ?b449 x ta tb tc
 2. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat 0x1F + unat (?b449 x ta tb tc) < 2 ^ LENGTH(32)
 3. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (2 subgoals):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> unat 0x1F + unat (mask 5) < 2 ^ LENGTH(32)
 2. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (if 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) then capability.NullCap else capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> (32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<forall>t. cap_get_tag (ret__struct_cap_C_' t) = 0 \<longrightarrow> ccap_relation capability.NullCap (ret__struct_cap_C_' t))) \<and> (\<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)))) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap\<rbrakk> \<Longrightarrow> \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))) \<longrightarrow> (\<exists>t. ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF) \<longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc t. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF\<rbrakk> \<Longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32 \<and> ((\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t))) proof (prove)
goal (2 subgoals):
 1. \<And>x ta tb tc t. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF\<rbrakk> \<Longrightarrow> unat ((newData_' x >> 3) && 0x1F) < 32
 2. \<And>x ta tb tc t. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF\<rbrakk> \<Longrightarrow> (\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)) proof (prove)
goal (2 subgoals):
 1. \<And>x ta tb tc t. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF\<rbrakk> \<Longrightarrow> (newData_' x >> 3) && 0x1F < 0x20
 2. \<And>x ta tb tc t. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF\<rbrakk> \<Longrightarrow> (\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc t. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF\<rbrakk> \<Longrightarrow> (\<exists>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = 0xA \<longrightarrow> ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' t)) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc t td te. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)); cap_get_tag (cap_' x) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x))); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF; cap_cnode_cap_lift (ret__struct_cap_C_' td) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = 0xA; cap_cnode_cap_lift (ret__struct_cap_C_' te) = cap_cnode_cap_lift (cap_' x)\<lparr>capCNodeGuard_CL := (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF, capCNodeGuardSize_CL := (newData_' x >> 3) && 0x1F\<rparr>; cap_get_tag (ret__struct_cap_C_' te) = 0xA\<rbrakk> \<Longrightarrow> ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift (cap_' x))) (unat (capCNodeRadix_CL (cap_cnode_cap_lift (cap_' x)))) ((newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) (unat ((newData_' x >> 3) && 0x1F))) (ret__struct_cap_C_' te) proof (prove)
goal (1 subgoal):
 1. \<And>x ta tb tc t td te. \<lbrakk>newData = newData_' x; preserve = to_bool (preserve_' x); ret__unsigned_' ta = 0xA; ret__unsigned_' tb = (newData_' x >> 3) && 0x1F; ret__unsigned_' tc = (cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5; cap_get_tag (cap_' x) = 0xA; \<not> 32 < unat ((newData_' x >> 3) && 0x1F) + unat ((cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5); ret__unsigned_' t = (newData_' x >> 8) && 0x3FFFF; (cap_C.words_C (ret__struct_cap_C_' td).[Suc 0] >> 18) && mask 5 = (cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5 \<and> (cap_C.words_C (ret__struct_cap_C_' td).[Suc 0] >> 23) && mask 5 = (cap_C.words_C (cap_' x).[Suc 0] >> 23) && mask 5 \<and> cap_C.words_C (ret__struct_cap_C_' td).[Suc 0] && mask 18 = (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF \<and> cap_C.words_C (ret__struct_cap_C_' td).[0] && ~~ mask 5 = cap_C.words_C (cap_' x).[0] && ~~ mask 5; cap_get_tag (ret__struct_cap_C_' td) = 0xA; (cap_C.words_C (ret__struct_cap_C_' te).[Suc 0] >> 18) && mask 5 = (cap_C.words_C (cap_' x).[Suc 0] >> 18) && mask 5 \<and> (cap_C.words_C (ret__struct_cap_C_' te).[Suc 0] >> 23) && mask 5 = (newData_' x >> 3) && 0x1F \<and> cap_C.words_C (ret__struct_cap_C_' te).[Suc 0] && mask 18 = (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF \<and> cap_C.words_C (ret__struct_cap_C_' te).[0] && ~~ mask 5 = cap_C.words_C (cap_' x).[0] && ~~ mask 5; cap_get_tag (ret__struct_cap_C_' te) = 0xA\<rbrakk> \<Longrightarrow> (newData_' x >> 8) && 0x3FFFF && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1 = (((newData_' x >> 8) && 0x3FFFF) && 2 ^ unat ((newData_' x >> 3) && 0x1F) - 1) && 0x3FFFF proof (prove)
goal:
No subgoals!