theory CSpace_C

lemma revokable_ccorres:
  "ccorres (\<lambda>a c. from_bool a = c) ret__unsigned_long_'
           (\<lambda>_. capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap)
           (UNIV \<inter> {s. ccap_relation cap (derivedCap_' s)} \<inter> {s. ccap_relation parent (srcCap_' s)}) hs
           (return (revokable' parent cap))
           (Call isCapRevocable_'proc)" apply (rule ccorres_gen_asm[where G=\<top>, simplified]) apply (cinit' lift: derivedCap_' srcCap_' simp: revokable'_def)
   \<comment> \<open>Clear up Arch cap case\<close> apply csymbr apply (clarsimp simp: cap_get_tag_isCap simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_rhs_assoc) apply (clarsimp simp: isCap_simps) apply csymbr apply (drule mp, fastforce) apply ccorres_rewrite apply (rule ccorres_return_C, clarsimp+) apply csymbr apply (rule_tac P'=UNIV and P=\<top> in ccorres_inst) apply (cases cap)
    \<comment> \<open>Uninteresting caps\<close> apply revokable'_hammer+
    \<comment> \<open>NotificationCap\<close> apply (simp add: cap_get_tag_isCap isCap_simps ccorres_cond_iffs) apply (rule ccorres_guard_imp, (rule ccorres_rhs_assoc)+, csymbr, csymbr) apply (rule ccorres_return_C, clarsimp+) apply (frule_tac cap'1=srcCap in cap_get_tag_NotificationCap[THEN iffD1]) apply (clarsimp simp: cap_get_tag_isCap isCap_simps is_simple_cap'_def) apply (frule_tac cap'1=derivedCap in cap_get_tag_NotificationCap[THEN iffD1]) apply (clarsimp simp: cap_get_tag_isCap isCap_simps) apply (fastforce simp: cap_get_tag_isCap isCap_simps)
    \<comment> \<open>IRQHandlerCap\<close> apply (simp add: cap_get_tag_isCap isCap_simps ccorres_cond_iffs) apply (rule ccorres_guard_imp, csymbr) apply (rule ccorres_return_C, clarsimp+) apply (fastforce simp: cap_get_tag_isCap isCap_simps)
    \<comment> \<open>EndpointCap\<close> apply (simp add: cap_get_tag_isCap isCap_simps ccorres_cond_iffs) apply (rule ccorres_guard_imp, (rule ccorres_rhs_assoc)+, csymbr, csymbr) apply (rule ccorres_return_C, clarsimp+) apply (frule_tac cap'1=srcCap in cap_get_tag_EndpointCap[THEN iffD1]) apply (clarsimp simp: cap_get_tag_isCap isCap_simps is_simple_cap'_def) apply (frule_tac cap'1=derivedCap in cap_get_tag_EndpointCap[THEN iffD1]) apply (clarsimp simp: cap_get_tag_isCap isCap_simps) apply (fastforce simp: cap_get_tag_isCap isCap_simps)
    \<comment> \<open>Other Caps\<close> by (revokable'_hammer | fastforce simp: isCap_simps)+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation parent \<acute>srcCap\<rbrace>) hs (return (revokable' parent cap)) (Call isCapRevocable_'proc) proof (prove)
goal (1 subgoal):
 1. capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>derivedCap\<rbrace> \<inter> \<lbrace>ccap_relation parent \<acute>srcCap\<rbrace>) hs (return (revokable' parent cap)) (Call isCapRevocable_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1060 srcCap derivedCap) (?Q'1060 srcCap derivedCap) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (\<acute>ret__unsigned_long :== CALL isArchCap_'proc(derivedCap);;
(IF 0 < \<acute>ret__unsigned_long THEN
  \<acute>ret__unsigned_long :== CALL Arch_isCapRevocable_'proc(derivedCap,srcCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)))
 2. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1060 srcCap derivedCap s \<and> s' \<in> ?Q'1060 srcCap derivedCap proof (prove)
goal (2 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned_long. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; ret__unsigned_long = from_bool (isArchCap_tag (cap_get_tag derivedCap))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1060 srcCap derivedCap) (?G'1069 srcCap derivedCap ret__unsigned_long) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF 0 < ret__unsigned_long THEN
  \<acute>ret__unsigned_long :== CALL Arch_isCapRevocable_'proc(derivedCap,srcCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 2. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1060 srcCap derivedCap s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'1069 srcCap derivedCap v} proof (prove)
goal (2 subgoals):
 1. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1060 srcCap derivedCap) (?G'1069 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF isArchCap (\<lambda>_. True) cap THEN
  \<acute>ret__unsigned_long :== CALL Arch_isCapRevocable_'proc(derivedCap,srcCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 2. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1060 srcCap derivedCap s \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'1069 srcCap derivedCap v} proof (prove)
goal (3 subgoals):
 1. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1404 srcCap derivedCap) (?S1408 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (\<acute>ret__unsigned_long :== CALL Arch_isCapRevocable_'proc(derivedCap,srcCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 2. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?T1407 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 3. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> ?Q1404 srcCap derivedCap s) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?S1408 srcCap derivedCap v) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?T1407 srcCap derivedCap v)}} proof (prove)
goal (3 subgoals):
 1. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1404 srcCap derivedCap) (?S1408 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (\<acute>ret__unsigned_long :== CALL Arch_isCapRevocable_'proc(derivedCap,srcCap);;
(return_C ret__unsigned_long_'_update ret__unsigned_long_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)))
 2. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?T1407 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 3. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> ?Q1404 srcCap derivedCap s) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?S1408 srcCap derivedCap v) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?T1407 srcCap derivedCap v)}} proof (prove)
goal (3 subgoals):
 1. \<And>srcCap derivedCap arch_cap. \<lbrakk>capMasterCap (capability.ArchObjectCap arch_cap) = capMasterCap parent \<or> is_simple_cap' (capability.ArchObjectCap arch_cap); ccap_relation parent srcCap; ccap_relation (capability.ArchObjectCap arch_cap) derivedCap; cap = capability.ArchObjectCap arch_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1404 srcCap derivedCap) (?S1408 srcCap derivedCap (SCAST(32 signed \<rightarrow> 32) true)) (SKIP # hs) (return False) (\<acute>ret__unsigned_long :== CALL Arch_isCapRevocable_'proc(derivedCap,srcCap);;
(return_C ret__unsigned_long_'_update ret__unsigned_long_';;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)))
 2. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?T1407 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 3. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> ?Q1404 srcCap derivedCap s) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?S1408 srcCap derivedCap v) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?T1407 srcCap derivedCap v)}} proof (prove)
goal (3 subgoals):
 1. \<And>srcCap derivedCap arch_cap ret__unsigned_long. \<lbrakk>capMasterCap (capability.ArchObjectCap arch_cap) = capMasterCap parent \<or> is_simple_cap' (capability.ArchObjectCap arch_cap); ccap_relation parent srcCap; ccap_relation (capability.ArchObjectCap arch_cap) derivedCap; cap = capability.ArchObjectCap arch_cap; (\<exists>c. ccap_relation c derivedCap) \<and> (\<exists>c'. ccap_relation c' srcCap) \<longrightarrow> ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1404 srcCap derivedCap) (?G'1432 srcCap derivedCap (SCAST(32 signed \<rightarrow> 32) true) ret__unsigned_long) (SKIP # hs) (return False) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long);;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 2. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?T1407 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 3. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> ?Q1404 srcCap derivedCap s) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>va v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> va = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'1432 srcCap derivedCap v va}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?T1407 srcCap derivedCap v)}} proof (prove)
goal (3 subgoals):
 1. \<And>srcCap derivedCap arch_cap ret__unsigned_long. \<lbrakk>capMasterCap (capability.ArchObjectCap arch_cap) = capMasterCap parent \<or> is_simple_cap' (capability.ArchObjectCap arch_cap); ccap_relation parent srcCap; ccap_relation (capability.ArchObjectCap arch_cap) derivedCap; cap = capability.ArchObjectCap arch_cap; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1404 srcCap derivedCap) (?G'1432 srcCap derivedCap (SCAST(32 signed \<rightarrow> 32) true) ret__unsigned_long) (SKIP # hs) (return False) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long);;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 2. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?T1407 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 3. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> ?Q1404 srcCap derivedCap s) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>va v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> va = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'1432 srcCap derivedCap v va}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?T1407 srcCap derivedCap v)}} proof (prove)
goal (3 subgoals):
 1. \<And>srcCap derivedCap arch_cap ret__unsigned_long. \<lbrakk>capMasterCap (capability.ArchObjectCap arch_cap) = capMasterCap parent \<or> is_simple_cap' (capability.ArchObjectCap arch_cap); ccap_relation parent srcCap; ccap_relation (capability.ArchObjectCap arch_cap) derivedCap; cap = capability.ArchObjectCap arch_cap; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q1404 srcCap derivedCap) (?G'1432 srcCap derivedCap (SCAST(32 signed \<rightarrow> 32) true) ret__unsigned_long) (SKIP # hs) (return False) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?T1407 srcCap derivedCap (from_bool (isArchCap (\<lambda>_. True) cap))) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI))
 3. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> ?Q1404 srcCap derivedCap s) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>va v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> va = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'1432 srcCap derivedCap v va}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?T1407 srcCap derivedCap v)}} proof (prove)
goal (2 subgoals):
 1. \<And>srcCap derivedCap. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?T1407 srcCap derivedCap (SCAST(32 signed \<rightarrow> 32) false)) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(derivedCap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> ?T1407 srcCap derivedCap v)}} proof (prove)
goal (2 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?R1404 srcCap derivedCap) (?G'1804 srcCap derivedCap (SCAST(32 signed \<rightarrow> 32) false) ret__unsigned) (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> ?R1404 srcCap derivedCap s)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>va. va = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> ?G'1804 srcCap derivedCap v va})}} proof (prove)
goal (2 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (13 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned x1. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x31 x32 x33 x34. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned x31 x32 x33 x34. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (x32 \<noteq> capNtfnBadge parent)) (\<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>srcCap derivedCap ret__unsigneda x31 x32 x33 x34 ret__unsigned unsigned_eret_2. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; ret__unsigneda = cap_get_tag derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; ret__unsigned = capNtfnBadge_CL (cap_notification_cap_lift derivedCap); unsigned_eret_2 = capNtfnBadge_CL (cap_notification_cap_lift srcCap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q2072 srcCap derivedCap ret__unsigneda x31 x32 x33 x34) (?G'2148 srcCap derivedCap ret__unsigneda x31 x32 x33 x34 ret__unsigned unsigned_eret_2) (SKIP # hs) (return (x32 \<noteq> capNtfnBadge parent)) (return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned \<noteq> unsigned_eret_2 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>srcCap derivedCap ret__unsigned x31 x32 x33 x34 s. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; True\<rbrakk> \<Longrightarrow> ?Q2072 srcCap derivedCap ret__unsigned x31 x32 x33 x34 s
 3. \<And>srcCap derivedCap ret__unsigned x31 x32 x33 x34 s. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v v'. v = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capNtfnBadge_CL (cap_notification_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> ?G'2148 srcCap derivedCap ret__unsigned x31 x32 x33 x34 v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_notification_cap}
 4. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>srcCap derivedCap x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> from_bool (x32 \<noteq> capNtfnBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))
 2. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>srcCap derivedCap x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap
 2. \<And>srcCap derivedCap x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; parent = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift srcCap)) (capNtfnBadge_CL (cap_notification_cap_lift srcCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift srcCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift srcCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> from_bool (x32 \<noteq> capNtfnBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))
 3. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>srcCap derivedCap x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; parent = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift srcCap)) (capNtfnBadge_CL (cap_notification_cap_lift srcCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift srcCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift srcCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> from_bool (x32 \<noteq> capNtfnBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))
 2. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>srcCap derivedCap x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; parent = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift srcCap)) (capNtfnBadge_CL (cap_notification_cap_lift srcCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift srcCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift srcCap)))\<rbrakk> \<Longrightarrow> cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap
 2. \<And>srcCap derivedCap x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; parent = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift srcCap)) (capNtfnBadge_CL (cap_notification_cap_lift srcCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift srcCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift srcCap))); capability.NotificationCap x31 x32 x33 x34 = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift derivedCap)) (capNtfnBadge_CL (cap_notification_cap_lift derivedCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift derivedCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift derivedCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> from_bool (x32 \<noteq> capNtfnBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))
 3. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>srcCap derivedCap x31 x32 x33 x34. \<lbrakk>capability.NotificationCap x31 0 True True = capMasterCap parent \<or> is_simple_cap' (capability.NotificationCap x31 x32 x33 x34); ccap_relation parent srcCap; ccap_relation (capability.NotificationCap x31 x32 x33 x34) derivedCap; cap = capability.NotificationCap x31 x32 x33 x34; parent = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift srcCap)) (capNtfnBadge_CL (cap_notification_cap_lift srcCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift srcCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift srcCap))); capability.NotificationCap x31 x32 x33 x34 = capability.NotificationCap (capNtfnPtr_CL (cap_notification_cap_lift derivedCap)) (capNtfnBadge_CL (cap_notification_cap_lift derivedCap)) (to_bool (capNtfnCanSend_CL (cap_notification_cap_lift derivedCap))) (to_bool (capNtfnCanReceive_CL (cap_notification_cap_lift derivedCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) \<noteq> capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> from_bool (x32 \<noteq> capNtfnBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<and> (capNtfnBadge_CL (cap_notification_cap_lift derivedCap) = capNtfnBadge_CL (cap_notification_cap_lift srcCap) \<longrightarrow> x32 \<noteq> capNtfnBadge parent \<and> from_bool (x32 \<noteq> capNtfnBadge parent) = 0))
 2. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (10 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned x4. \<lbrakk>capability.IRQHandlerCap x4 = capMasterCap parent \<or> is_simple_cap' (capability.IRQHandlerCap x4); ccap_relation parent srcCap; ccap_relation (capability.IRQHandlerCap x4) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (parent = capability.IRQControlCap)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (12 subgoals):
 1. \<And>srcCap derivedCap ret__unsigneda x4 ret__unsigned. \<lbrakk>capability.IRQHandlerCap x4 = capMasterCap parent \<or> is_simple_cap' (capability.IRQHandlerCap x4); ccap_relation parent srcCap; ccap_relation (capability.IRQHandlerCap x4) derivedCap; ret__unsigneda = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4; ret__unsigned = cap_get_tag srcCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q2291 srcCap derivedCap ret__unsigneda x4) (?G'2298 srcCap derivedCap ret__unsigneda x4 ret__unsigned) (SKIP # hs) (return (parent = capability.IRQControlCap)) (return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>srcCap derivedCap ret__unsigned x4 s. \<lbrakk>capability.IRQHandlerCap x4 = capMasterCap parent \<or> is_simple_cap' (capability.IRQHandlerCap x4); ccap_relation parent srcCap; ccap_relation (capability.IRQHandlerCap x4) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4; True\<rbrakk> \<Longrightarrow> ?Q2291 srcCap derivedCap ret__unsigned x4 s
 3. \<And>srcCap derivedCap ret__unsigned x4 s. \<lbrakk>capability.IRQHandlerCap x4 = capMasterCap parent \<or> is_simple_cap' (capability.IRQHandlerCap x4); ccap_relation parent srcCap; ccap_relation (capability.IRQHandlerCap x4) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQHandlerCap x4; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2298 srcCap derivedCap ret__unsigned x4 v}
 4. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>srcCap derivedCap x4. \<lbrakk>capability.IRQHandlerCap x4 = capMasterCap parent \<or> is_simple_cap' (capability.IRQHandlerCap x4); ccap_relation parent srcCap; ccap_relation (capability.IRQHandlerCap x4) derivedCap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> parent = capability.IRQControlCap) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap \<longrightarrow> from_bool (parent = capability.IRQControlCap) = 0)
 2. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (9 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (9 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (x52 \<noteq> capEPBadge parent)) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (11 subgoals):
 1. \<And>srcCap derivedCap ret__unsigneda x51 x52 x53 x54 x55 x56 ret__unsigned unsigned_eret_2. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; ret__unsigneda = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift derivedCap); unsigned_eret_2 = capEPBadge_CL (cap_endpoint_cap_lift srcCap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (?Q2361 srcCap derivedCap ret__unsigneda x51 x52 x53 x54 x55 x56) (?G'2437 srcCap derivedCap ret__unsigneda x51 x52 x53 x54 x55 x56 ret__unsigned unsigned_eret_2) (SKIP # hs) (return (x52 \<noteq> capEPBadge parent)) (return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned \<noteq> unsigned_eret_2 then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56 s. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; True\<rbrakk> \<Longrightarrow> ?Q2361 srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56 s
 3. \<And>srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56 s. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; ret__unsigned = cap_get_tag derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. srcCap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> ?G'2437 srcCap derivedCap ret__unsigned x51 x52 x53 x54 x55 x56 v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. srcCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}
 4. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>srcCap derivedCap x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> from_bool (x52 \<noteq> capEPBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))
 2. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (10 subgoals):
 1. \<And>srcCap derivedCap x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 2. \<And>srcCap derivedCap x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; parent = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift srcCap)) (capEPBadge_CL (cap_endpoint_cap_lift srcCap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift srcCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> from_bool (x52 \<noteq> capEPBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))
 3. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (9 subgoals):
 1. \<And>srcCap derivedCap x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; parent = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift srcCap)) (capEPBadge_CL (cap_endpoint_cap_lift srcCap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift srcCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> from_bool (x52 \<noteq> capEPBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))
 2. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (10 subgoals):
 1. \<And>srcCap derivedCap x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; parent = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift srcCap)) (capEPBadge_CL (cap_endpoint_cap_lift srcCap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift srcCap)))\<rbrakk> \<Longrightarrow> cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap
 2. \<And>srcCap derivedCap x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; parent = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift srcCap)) (capEPBadge_CL (cap_endpoint_cap_lift srcCap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift srcCap))); capability.EndpointCap x51 x52 x53 x54 x55 x56 = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift derivedCap)) (capEPBadge_CL (cap_endpoint_cap_lift derivedCap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift derivedCap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift derivedCap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift derivedCap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift derivedCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> from_bool (x52 \<noteq> capEPBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))
 3. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 10. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (9 subgoals):
 1. \<And>srcCap derivedCap x51 x52 x53 x54 x55 x56. \<lbrakk>capability.EndpointCap x51 0 True True True True = capMasterCap parent \<or> is_simple_cap' (capability.EndpointCap x51 x52 x53 x54 x55 x56); ccap_relation parent srcCap; ccap_relation (capability.EndpointCap x51 x52 x53 x54 x55 x56) derivedCap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56; parent = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift srcCap)) (capEPBadge_CL (cap_endpoint_cap_lift srcCap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift srcCap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift srcCap))); capability.EndpointCap x51 x52 x53 x54 x55 x56 = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift derivedCap)) (capEPBadge_CL (cap_endpoint_cap_lift derivedCap)) (to_bool (capCanSend_CL (cap_endpoint_cap_lift derivedCap))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift derivedCap))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift derivedCap))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift derivedCap)))\<rbrakk> \<Longrightarrow> (cap_get_tag srcCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (cap_get_tag derivedCap = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) \<noteq> capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> from_bool (x52 \<noteq> capEPBadge parent) = 0)) \<and> (cap_get_tag derivedCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))) \<and> (cap_get_tag srcCap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<and> (capEPBadge_CL (cap_endpoint_cap_lift derivedCap) = capEPBadge_CL (cap_endpoint_cap_lift srcCap) \<longrightarrow> x52 \<noteq> capEPBadge parent \<and> from_bool (x52 \<noteq> capEPBadge parent) = 0))
 2. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 9. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}} proof (prove)
goal (8 subgoals):
 1. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 2. \<And>srcCap derivedCap ret__unsigned x71 x72 x73. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 3. \<And>srcCap derivedCap ret__unsigned x8. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 4. \<And>srcCap derivedCap ret__unsigned x91 x92 x93. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 5. \<And>srcCap derivedCap ret__unsigned x101 x102 x103 x104. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 6. \<And>srcCap derivedCap ret__unsigned x111 x112 x113 x114. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 7. \<And>srcCap derivedCap ret__unsigned. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; \<not> isArchCap (\<lambda>_. True) cap; ret__unsigned = cap_get_tag derivedCap; cap = capability.IRQControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a. (=) (from_bool a)) ret__unsigned_long_' (\<lambda>_. True) UNIV (SKIP # hs) (return (case cap of capability.NotificationCap x xa xb xc \<Rightarrow> capNtfnBadge cap \<noteq> capNtfnBadge parent | capability.IRQHandlerCap x \<Rightarrow> isIRQControlCap parent | capability.EndpointCap x xa xb xc xd xe \<Rightarrow> capEPBadge cap \<noteq> capEPBadge parent | capability.ArchObjectCap x \<Rightarrow> Arch.isCapRevocable cap parent | capability.UntypedCap x xa xb xc \<Rightarrow> True | _ \<Rightarrow> False)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_endpoint_cap_get_capEPBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_notification_cap THEN
  \<acute>ret__unsigned :== CALL cap_notification_cap_get_capNtfnBadge_'proc(derivedCap);;
\<acute>unsigned_eret_2 :== CALL cap_notification_cap_get_capNtfnBadge_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s \<noteq> unsigned_eret_2_' s then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_irq_handler_cap THEN
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(srcCap);;
return_C ret__unsigned_long_'_update (\<lambda>s. if ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) cap_irq_control_cap then SCAST(32 signed \<rightarrow> 32) 1 else SCAST(32 signed \<rightarrow> 32) 0)
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) true)
ELSE
  return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) false)
FI
FI
FI
FI)
 8. \<And>srcCap derivedCap s s'. \<lbrakk>capMasterCap cap = capMasterCap parent \<or> is_simple_cap' cap; ccap_relation parent srcCap; ccap_relation cap derivedCap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((isArchCap (\<lambda>_. True) cap \<longrightarrow> True) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>v. v = from_bool (isArchCap_tag (cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v v'. (\<forall>c c'. ccap_relation c (derivedCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<and> ccap_relation c' (srcCap_' (srcCap_'_update (\<lambda>_. srcCap) (derivedCap_'_update (\<lambda>_. derivedCap) s))) \<longrightarrow> v = from_bool (Arch.isCapRevocable c c')) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> \<lbrace>from_bool False = v\<rbrace>}} \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> isArchCap (\<lambda>_. True) cap \<longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. derivedCap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV})}}